Order tracking

Let guests open an order's status page with a one-time code sent to the contact saved on the order.

POST /track/request

{% form 'order_track_request' %}

Requests a one-time tracking code for a guest order. The response is the same whether or not the details match an order; the code is sent to the contact saved on the order.

Form fields

order_number Required: Order number as shown on the confirmation (with or without #).
contact Required: The email address or phone number used at checkout. It must match the contact saved on the order. The code is always sent to that saved contact, never to the value typed here.
website Optional: Honeypot — must stay empty; bots that fill it are dropped.
_format Optional: Set to json when submitting with fetch; omit for the normal browser redirect.

Validation

Requires the CSRF token and an empty honeypot. During unusually heavy traffic the storefront may ask the shopper to complete a verification challenge first. The order number and contact must match the contact saved on the order. The response is the same when the details match, when they do not, and when a code was sent recently, so it never reveals whether an order exists.

Limits

The code has 6 digits, expires after 10 minutes, and allows 5 attempts. At most 3 codes are sent per order per hour; further requests get the same response without sending a code.

Response

{
  success:true,
  response,
  redirect
}

response is the same message whether or not a code was sent. redirect is present only when a signed-in customer tracks their own order and goes straight to its order-status page. When the store has turned order tracking off, the action returns HTTP 403 with ORDER_TRACKING_DISABLED in user_errors.

POST /track/verify

{% form 'order_track_verify' %}

Checks a tracking code. A correct code opens a private order-status page for that order.

Form fields

order_number Required: Order number from the request step.
contact Required: Contact from the request step.
code Required: The 6-digit tracking code.
_format Optional: Set to json when submitting with fetch; omit for the normal browser redirect.

Validation

Requires the CSRF token. A wrong order number, contact, or code, an expired code, and a code with no attempts left all return the same error, STOREFRONT_CUST_INVALID_EXPIRED_CODE. A correct code works once and opens a private order-status page that stays available for 30 days.

Limits

5 attempts per code; a used code cannot be reused.

Response

{
  success:true,
  response,
  redirect
}

redirect is the order-status page. A refused code returns HTTP 400 with success: false and user_errors. A form submission redirects to the order-status page with HTTP 303.