Enable guest shoppers to look up their order status, shipment tracking, and other details in Storefront Next for orders placed without authentication or account registration. The self-service order lookup feature reduces support inquiries and costs, and improves the post-purchase shopper experience. To make sure only the order recipient can access the order details, guest shoppers must undergo multi-factor verification via email. Guest order lookup returns read-only order details—guests can’t make changes to the order, such as canceling an order or returning order items, which require authentication. This feature is turned off by default.
Shoppers must provide an email address that isn’t associated with a registered account. To look up an order based on an email tied to a registered account, shoppers must log in to their account.
Important
To view order details as a guest shopper, follow a two-step verification process by performing these steps:
Click Order Lookup in the storefront footer.
Enter the order number and your email address.
After submitting these details, you receive a 6-digit one-time verification code in an email.
The access code expires after 15 minutes. You can request a new code if needed. B2C Commerce sets the expiration time and it isn’t configurable in the storefront.
Note
Enter the verification code, and view the order details, such as the order status, date, order items, and shipping information.
Guest Order Lookup Configuration
Configure guest order lookup settings in the app config file, config.server.ts, or by using environment variables.
Configure Guest Order Lookup in the App Config File
Regex pattern for validating order number format on the form.
cooldownSeconds
number
60
Minimum seconds between code requests per IP address.
allowedFields
string[]
See config.server.ts
Allowlist of order fields the server returns to the client after verification.
turnstile.enabled
boolean
true
Enable Cloudflare Turnstile bot protection on the verification form.
turnstile.failOpen
boolean
false
When true, allow requests through if Turnstile is unreachable.
Routes
When enabled, these routes are registered:
/order-lookup — Request verification code form
/order-lookup/verify/:orderNo — Enter verification code form
/order-lookup/results/:orderNo — View order details (after verification)
All routes automatically redirect authenticated users to /account/orders.
API Integration
Guest order lookup uses the guestOrderLookup API call in B2C Commerce API (SCAPI) to fetch order data.
Guest Order Lookup Considerations
Field-Level Security
Guest order lookup suppresses these fields for security.
Cardholder name
Full phone number
Payment details (beyond masked method)
Billing address
Detailed financial information
Security
HttpOnly session cookie: After successful verification, the server writes cc-goa_{siteId} with Secure; HttpOnly; SameSite=Strict. The cookie isn’t readable from JavaScript.
Turnstile Bot Protection
Storefront Next integrates Cloudflare Turnstile on the guest order lookup form. Turnstile is enabled by default (turnstile.enabled: true) and blocks automated requests before they reach SCAPI.
Set turnstile.failOpen: true to allow requests through if the Turnstile service is unreachable. The default (false) blocks requests when Turnstile can’t be reached, which is the more secure posture for production.
No Persistent Storage
No order data or personally-identifiable information persists beyond browser session.
Access tokens are short-lived and can’t be reused.
All data is cleared on browser close.
Troubleshooting
Feature Not Visible
Problem: “Order Lookup” link not appearing
Solution:
Check config.app.guestOrderLookup.enabled is true
Verify configuration is loaded correctly
Clear browser cache and reload
Verification Codes Not Sending
Problem: Shoppers not receiving verification codes
Solution:
Check email service configuration
Verify SCAPI requestOrderAccessCode endpoint is accessible
Check API logs for errors
Verify shopper’s email address is valid
Order Not Found Errors
Problem: Valid orders returning “not found”
Solution:
Verify order number format matches configuration regex
j