Overview
Shoppers can sign in to keep saved addresses and a wishlist, see their orders, and review products they have bought. Sign-in is passwordless: the shopper proves they own their email with a one-time code.
Signing in
- Request a code. Send the shopper’s email to Request Sign-in Code. They receive a 6-digit code from your store’s name.
- Sign in. Send the email and the code to Sign In. The response returns a session
tokenand the account. - Use the token. Send it in the
shopper-tokenheader on account, order history, wishlist and review requests, and on checkout.
A code expires after 10 minutes, allows 5 wrong tries, and works once. Requesting a new code cancels the previous one.
The session token is the only thing protecting the shopper’s account. Keep it out of URLs and logs, for example in an httpOnly cookie set by your server.
A session lasts 30 days. Sign Out ends it early. A request with a missing or expired token returns 401 with sign in to continue; send the shopper back to sign in.
One account per workspace
An account belongs to the workspace, not to one sales channel, so the same sign-in works on every store the merchant runs on Papertracc. On the first sign-in, Papertracc links the account to the workspace’s customer with the same email, or creates that customer. Shopper edits to their name or phone change the account only, not the merchant’s customer record.
Addresses, wishlist and measurements
- An account keeps up to 20 addresses. The first one saved is the default, and making another the default unsets the old one.
- A wishlist holds up to 200 products, newest first. Products that stop being sold on the channel drop out of the list.
- An account keeps up to 20 named measurement sets, such as “Me” or “My son”, for made-to-measure requests. Saving under an existing name replaces that set. See Requests.
Limits
In any 15 minutes, a code can be requested 3 times for one email address and 10 times by one shopper, and a shopper can enter 20 wrong codes before they must wait.