Guest Order Lookup for Unregistered Shoppers

Enable guest shoppers to look up their order status, shipment tracking, and other details in a PWA Kit store for orders placed without authentication or account registration. The self-service order lookup feature reduces support inquiries and improves the post-purchase shopper experience. To make sure only the order recipient can access order details, guest shoppers must undergo multi-factor verification via email. This feature is turned off by default.

To view order details as a guest shopper:

1. Click Order Lookup in the storefront footer.

2. Enter your order number and email address. After submitting these details, you receive a 6-digit access code by email.

   The access code expires after 15 minutes. You can request a new code if needed. B2C Commerce sets the expiration time and it isn’t configurable in the storefront.

3. Enter the access code to view your order details, including status, order items, and shipping information.

• PWA Kit v3.21 or later.
• Cookies allowed:
  • The server writes a Secure; HttpOnly; SameSite=Strict session cookie after verification.
  • For local development, set localAllowCookies: true in the SSR server options (app/ssr.js). For MRT deployments, set MRT_ALLOW_COOKIES=true. Without either setting, the MRT runtime silently strips Set-Cookie headers—verification appears to succeed but the order lookup returns 404.
  • Local development also requires HTTPS. Run the dev server with pwa-kit-dev --https so that the browser accepts the secure cookie. Plain-HTTP local server runs can’t complete the verification flow.
• Business Manager email hook: The sfcc.app.order.sendOrderAccessCode hook must be configured and active in Business Manager for shoppers to receive access codes.

Configure guest order lookup in the app.guestOrderLookup key of config/default.js.

Guest order lookup uses the guestOrderLookup API call in B2C Commerce API (SCAPI) to fetch order data.

• Guest order lookup suppresses these fields for security.
  • Cardholder name
  • Full phone number
  • Payment details (beyond masked method)
  • Billing address
  • Detailed financial information

• HttpOnly session cookie: After successful verification, the server writes cc-goa_{siteId} with Secure; HttpOnly; SameSite=Strict. The cookie isn’t readable from JavaScript.

• No order data or personally-identifiable information persists beyond browser session.
• Session data expires after 15 minutes (Max-Age=900) regardless of browser state.

Problem: Footer “Order Lookup” link doesn’t appear.

Solution: Check that app.guestOrderLookup.enabled is true in the config loaded by the running server. Config changes require a server restart. Confirm the correct config file is active by checking NODE_ENV and any environment-specific overrides.

Problem: Shoppers aren’t receiving the access code email.

Solution: The access code email is triggered by the B2C Commerce Business Manager hook sfcc.app.order.sendOrderAccessCode. Verify the hook is configured and active in Business Manager. PWA Kit calls the SCAPI endpoint only — it doesn’t control email delivery and can’t detect whether the email was delivered.

Problem: Session cookie isn’t set after verification.

Solution: Check that cookies are allowed. For local development, set localAllowCookies: true in the SSR server options. For MRT deployments, set MRT_ALLOW_COOKIES=true. Without this, the Set-Cookie header is silently dropped and subsequent order lookup requests fail with 404.

Problem: Rate limiting is rejecting legitimate requests.

Solution: The default throttle allows 5 verify attempts per IP per 60-second window. Increase requestCodeThrottle.max or requestCodeThrottle.windowMs in config/default.js if needed. In MRT deployments, all requests arrive from the MRT proxy IP, so IP-based throttling applies to all shoppers equally. Consider a higher max for MRT-deployed storefronts.