---
schema_version: "1"
id: 17ad584812323534bd2a08027080b682b1e84b69b92d3e62adb7a1a429e710a3
title: Guest Order Lookup for Unregistered Shoppers
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/pwa-kit-managed-runtime/guides/pwa-guest-order.md
canonical_url: https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/pwa-guest-order.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 77fdf55fedae8c192bf518fa5e838d4af10d6ba7cb6e6fdffbbc9229c14aaa82
products:
  - Composable Storefront
  - Salesforce APIs
---
# Guest Order Lookup for Unregistered Shoppers

Enable guest shoppers to look up their order status, shipment tracking, and other details in a PWA Kit store for orders placed without authentication or account registration. The self-service order lookup feature reduces support inquiries and improves the post-purchase shopper experience. To make sure only the order recipient can access order details, guest shoppers must undergo multi-factor verification via email. This feature is turned off by default.

**important:** Shoppers must provide an email address that isn't associated with a registered account. To look up an order based on an email tied to a registered account, shoppers must log in to their account.

To view order details as a guest shopper:

1. Click **Order Lookup** in the storefront footer.
2. Enter your order number and email address.
   After submitting these details, you receive a 6-digit access code by email.

   **note:** The access code expires after 15 minutes. You can request a new code if needed. B2C Commerce sets the expiration time and it isn't configurable in the storefront.

3. Enter the access code to view your order details, including status, order items, and shipping information.

## Prerequisites

- [PWA Kit](https://github.com/SalesforceCommerceCloud/pwa-kit) v3.21 or later.
- Cookies allowed:
  - The server writes a `Secure; HttpOnly; SameSite=Strict` session cookie after verification.
  - For local development, set `localAllowCookies: true` in the SSR server options (`app/ssr.js`). For MRT deployments, set `MRT_ALLOW_COOKIES=true`. Without either setting, the MRT runtime silently strips `Set-Cookie` headers—verification appears to succeed but the order lookup returns 404.
  - Local development also requires HTTPS. Run the dev server with `pwa-kit-dev --https` so that the browser accepts the secure cookie. Plain-HTTP local server runs can't complete the verification flow.
- Business Manager email hook: The `sfcc.app.order.sendOrderAccessCode` hook must be configured and active in Business Manager for shoppers to receive access codes.

## Guest Order Lookup Configuration

Configure guest order lookup in the `app.guestOrderLookup` key of `config/default.js`.

```js
// config/default.js
module.exports = {
  app: {
    guestOrderLookup: {
      enabled: true,
      orderNumberRegex: '^[a-zA-Z0-9-]{6,32}$',
      requestCodeThrottle: {
        windowMs: 60000, // 1-minute rolling window
        max: 5 // max verify attempts per IP per window
      }
    }
  }
}
```

### Configuration Options

| Option                         | Type    | Default                  | Description                                                                                                         |
| ------------------------------ | ------- | ------------------------ | ------------------------------------------------------------------------------------------------------------------- |
| `enabled`                      | boolean | `false`                  | Enables or disables the feature. When `false`, all `/order-lookup` routes return 503 and the footer link is hidden. |
| `orderNumberRegex`             | string  | `'^[a-zA-Z0-9-]{6,32}$'` | Regex applied client-side to validate the order number format. Adjust to match your order ID format.                |
| `requestCodeThrottle.windowMs` | number  | `60000`                  | Rolling window in milliseconds for the rate limit on `POST /api/order-lookup/verify`.                               |
| `requestCodeThrottle.max`      | number  | `5`                      | Maximum verification attempts per IP address within `windowMs`. Requests over the limit receive HTTP 429.           |

## API Integration

Guest order lookup uses the [guestOrderLookup](https://developer.salesforce.com/docs/commerce/commerce-api/references/shopper-orders?meta=guestOrderLookup) API call in B2C Commerce API (SCAPI) to fetch order data.

## Guest Order Lookup Considerations

### Field-Level Security

- Guest order lookup suppresses these fields for security.
  - Cardholder name
  - Full phone number
  - Payment details (beyond masked method)
  - Billing address
  - Detailed financial information

## Security

- HttpOnly session cookie: After successful verification, the server writes `cc-goa_{siteId}` with `Secure; HttpOnly; SameSite=Strict`. The cookie isn't readable from JavaScript.

### No Persistent Storage

- No order data or personally-identifiable information persists beyond browser session.
- Session data expires after 15 minutes (Max-Age=900) regardless of browser state.

## Troubleshooting

### Feature Not Visible

**Problem**: Footer "Order Lookup" link doesn't appear.

**Solution**: Check that `app.guestOrderLookup.enabled` is `true` in the config loaded by the running server. Config changes require a server restart. Confirm the correct config file is active by checking `NODE_ENV` and any environment-specific overrides.

### Access Codes Not Sending

**Problem**: Shoppers aren't receiving the access code email.

**Solution**: The access code email is triggered by the B2C Commerce Business Manager hook `sfcc.app.order.sendOrderAccessCode`. Verify the hook is configured and active in Business Manager. PWA Kit calls the SCAPI endpoint only — it doesn't control email delivery and can't detect whether the email was delivered.

### Session Cookie Issues

**Problem**: Session cookie isn't set after verification.

**Solution**: Check that cookies are allowed. For local development, set `localAllowCookies: true` in the SSR server options. For MRT deployments, set `MRT_ALLOW_COOKIES=true`. Without this, the `Set-Cookie` header is silently dropped and subsequent order lookup requests fail with 404.

### Access Code Locked After Too Many Attempts

**Problem**: Rate limiting is rejecting legitimate requests.

**Solution**: The default throttle allows 5 verify attempts per IP per 60-second window. Increase `requestCodeThrottle.max` or `requestCodeThrottle.windowMs` in `config/default.js` if needed. In MRT deployments, all requests arrive from the MRT proxy IP, so IP-based throttling applies to all shoppers equally. Consider a higher `max` for MRT-deployed storefronts.