Give shoppers a useful account
Customer accounts are optional. When you use them, the API covers registration, email verification, password recovery, profile updates, and order history.
The sign-in flow
Registration always returns a successful response and sends the shopper an email. This prevents account enumeration. After verification, login returns a session token for the storefront server.
mutation Login($email: String!, $password: String!) {
customerLogin(email: $email, password: $password) {
token
expiresAt
}
}Google and Apple
Shoppers can also continue with Google or Apple; there is no separate sign-up. Send the browser to GET /api/v1/storefront/oauth/google/start (or apple) with host (your storefront host), return (an HTTPS page on one of your store's domains) and next. Cartly comes back to return with a one-time code, or an error to show. Trade the code on your server; it works once, for two minutes, at your store only.
mutation FinishSignIn($code: String!) {
customerProviderSignIn(code: $code) {
token
expiresAt
}
}The account is the store's account with the same verified email, or a new one. It has no password until the shopper sets one with password recovery.
Profile and orders
Fetch customerAccount and customerOrders together to build an account overview. Orders are scoped to the current storefront and returned newest first.
Password recovery
Request a reset email with requestCustomerPasswordReset, then submit the token from that email to resetCustomerPassword. Both endpoints intentionally avoid revealing whether an email exists.