Guest Order Lookup for Unregistered Shoppers

Enable guest shoppers to look up their order status, shipment tracking, and other details in a PWA Kit store for orders placed without authentication or account registration. The self-service order lookup feature reduces support inquiries and improves the post-purchase shopper experience. To make sure only the order recipient can access order details, guest shoppers must undergo multi-factor verification via email. Guest order lookup returns read-only order details—guests can’t make changes to the order, such as canceling an order or returning order items, which require authentication. This feature is turned off by default.

Shoppers must provide an email address that isn’t associated with a registered account. To look up an order based on an email tied to a registered account, shoppers must log in to their account.

Important

To view order details as a guest shopper, complete a two-step verification process:

Click Order Lookup in the storefront footer.
Enter your order number and email address. After submitting these details, you receive a 6-digit access code by email.

The access code expires after 15 minutes. You can request a new code if needed. B2C Commerce sets the expiration time and it isn’t configurable in the storefront.
Note
Enter the access code to view your order details, including status, order items, and shipping information.

Prerequisites

Cookies allowed: The server writes a Secure; HttpOnly; SameSite=Strict session cookie after verification. For local development, set localAllowCookies: true in the SSR server options (app/ssr.js). For MRT deployments, set MRT_ALLOW_COOKIES=true. Without either setting, the MRT runtime silently strips Set-Cookie headers—verification appears to succeed but the order lookup returns 404.
Business Manager email hook: The sfcc.app.order.sendOrderAccessCode hook must be configured and active in Business Manager for shoppers to receive access codes.

Guest Order Lookup Configuration

Configure guest order lookup in the app.guestOrderLookup key of config/default.js.

1// config/default.js
2module.exports = {
3  app: {
4    guestOrderLookup: {
5      enabled: true,
6      orderNumberRegex: '^[a-zA-Z0-9-]{6,32}$',
7      requestCodeThrottle: {
8        windowMs: 60000, // 1-minute rolling window
9        max: 5 // max verify attempts per IP per window
10      }
11    }
12  }
13}

Configuration Options

Option	Type	Default	Description
`enabled`	boolean	`false`	Enables or disables the feature. When `false`, all `/order-lookup` routes return 404 and the footer link is hidden.
`orderNumberRegex`	string	`'^[a-zA-Z0-9-]{6,32}$'`	Regex applied client-side to validate the order number format. Adjust to match your order ID format.
`requestCodeThrottle.windowMs`	number	`60000`	Rolling window in milliseconds for the rate limit on `POST /api/order-lookup/verify`.
`requestCodeThrottle.max`	number	`5`	Maximum verification attempts per IP address within `windowMs`. Requests over the limit receive HTTP 429.

API Integration

Guest order lookup uses the guestOrderLookup API call in B2C Commerce API (SCAPI) to fetch order data.

Guest Order Lookup Considerations

Field-Level Security

Guest order lookup suppresses these fields for security.
- Cardholder name
- Full phone number
- Payment details (beyond masked method)
- Billing address
- Detailed financial information

Security

HttpOnly session cookie: After successful verification, the server writes cc-goa_{siteId} with Secure; HttpOnly; SameSite=Strict. The cookie isn’t readable from JavaScript.

No Persistent Storage

No order data or personally-identifiable information persists beyond browser session.
Access tokens are short-lived and can’t be reused.
All data is cleared on browser close.

Troubleshooting

Footer “Order Lookup” link doesn’t appear

Check that app.guestOrderLookup.enabled is true in the config loaded by the running server. Config changes require a server restart. Confirm the correct config file is active by checking NODE_ENV and any environment-specific overrides.

Session cookie isn’t set after verification

Check that cookies are allowed. For local development, set localAllowCookies: true in the SSR server options. For MRT deployments, set MRT_ALLOW_COOKIES=true. Without this, the Set-Cookie header is silently dropped and subsequent order lookup requests fail with 404.

Shoppers aren’t receiving the access code email

The access code email is triggered by the B2C Commerce Business Manager hook sfcc.app.order.sendOrderAccessCode. Verify the hook is configured and active in Business Manager. PWA Kit calls the SCAPI endpoint only — it doesn’t control email delivery and can’t detect whether the email was delivered.

Access code is rejected

The code expires after 15 minutes. If the shopper waited too long, they need to restart the flow. Also check that the clock skew between the MRT server and B2C Commerce doesn’t exceed the TTL.

Rate limiting is rejecting legitimate requests

The default throttle allows 5 verify attempts per IP per 60-second window. Increase requestCodeThrottle.max or requestCodeThrottle.windowMs in config/default.js if needed. In MRT deployments, all requests arrive from the MRT proxy IP, so IP-based throttling applies to all shoppers equally — consider a higher max for MRT-deployed storefronts.