Enable guest shoppers to look up their order status, shipment tracking, and other details in Storefront Next for orders placed without authentication or account registration. The self-service order lookup feature reduces support inquiries and costs, and improves the post-purchase shopper experience. To make sure only the order recipient can access the order details, guest shoppers must undergo multi-factor verification via email. This feature is turned off by default.
Shoppers must provide an email address that isn’t associated with a registered account. To look up an order based on an email tied to a registered account, shoppers must log in to their account.
Important
To view order details as a guest shopper:
Click Order Lookup in the storefront footer.
Enter the order number and your email address.
After submitting these details, you receive a 6-digit one-time access code in an email.
The access code expires after 15 minutes. You can request a new code if needed. B2C Commerce sets the expiration time and it isn’t configurable in the storefront.
Note
Enter the access code, and view the order details, such as the order status, date, order items, and shipping information.
GUEST_ORDER_LOOKUP_COOKIE_SECRET environment variable: Set this variable to sign the session cookie that stores order access state. For local development, add it to your .env file. For MRT deployments, set it in your Managed Runtime project environment variables. If unset, the feature falls back to CLIENT_SECRET. If neither is set, every request returns CONFIGURATION_ERROR.
Business Manager email hook: The sfcc.app.order.sendOrderAccessCode hook must be configured and active in Business Manager for shoppers to receive access codes.
Guest Order Lookup Configuration
Configure guest order lookup settings in the app config file, config.server.ts, or by using environment variables.
Configure Guest Order Lookup in the App Config File
Regex pattern for validating order number format on the form.
cooldownSeconds
number
60
Minimum seconds between code requests per IP address.
allowedFields
string[]
See config.server.ts
Allowlist of order fields the server returns to the client after verification.
turnstile.enabled
boolean
true
Enable Cloudflare Turnstile bot protection on the verification form.
turnstile.failOpen
boolean
false
When true, allow requests through if Turnstile is unreachable.
Routes
When enabled, these routes are registered:
/order-lookup — Request access code form
/order-lookup/verify/:orderNo — Enter access code form
/order-lookup/results/:orderNo — View order details (after verification)
The /order-lookup route (from the entry form) routes redirects authenticated users to /account/orders.
API Integration
Guest order lookup uses the guestOrderLookup API call in B2C Commerce API (SCAPI) to fetch order data.
Guest Order Lookup Considerations
Field-Level Security
Guest order lookup suppresses these fields for security.
Cardholder name
Full phone number
Payment details (beyond masked method)
Billing address
Detailed financial information
Security
HttpOnly session cookie: After successful verification, the server writes glo_order_<orderHash> with Secure; HttpOnly; SameSite=Strict. The cookie isn’t readable from JavaScript.
Turnstile Bot Protection
Storefront Next integrates Cloudflare Turnstile on the guest order lookup form. Turnstile is enabled by default (turnstile.enabled: true) and blocks automated requests before they reach SCAPI.
Set turnstile.failOpen: true to allow requests through if the Turnstile service is unreachable. The default (false) blocks requests when Turnstile can’t be reached, which is the more secure posture for production.
No Persistent Storage
No order data or personally-identifiable information persists beyond browser session.
Session data expires after 15 minutes (Max-Age=900) regardless of browser state.
Troubleshooting
Feature Not Visible
Problem: Footer “Order Lookup” link doesn’t appear.
Solution:
Check config.app.guestOrderLookup.enabled is true.
Verify configuration is loaded correctly.
Clear browser cache and reload.
Access Codes Not Sending
Problem: Shoppers don’t receive an access code.
Solution:
Check email service configuration.
Verify SCAPI requestOrderAccessCode endpoint is accessible.
Check API logs for errors.
Verify shopper’s email address is valid.
Order Not Found Errors
Problem: Valid orders return “not found”.
Solution:
Verify order number format matches configuration regex.
Problem: Shopper entered the wrong access code five times and is locked out. The form rejects all further attempts, even a correct code.
Cause: After five failed attempts, Storefront Next marks the order-state cookie as ATTEMPTS_EXCEEDED. The cookie is permanently locked—further entries are rejected regardless of whether the code is correct.
Solution: The shopper must restart the order lookup and request a new access code. Requesting a new code issues a fresh order-state cookie and resets the attempt counter. The previous locked cookie is replaced automatically. The shopper doesn’t need to clear cookies or take any other action.
Access Code Request Errors
Problem: Shoppers receive errors when requesting an access code too quickly.
Solution:
Review the cooldownSeconds setting (default: 60 seconds between requests per IP address).
Check if a proxy or load balancer is forwarding the correct client IP address.
Consider lowering cooldownSeconds for production if the default is too strict.
j