Przejdź do głównej zawartości

orderByToken

Fetch a single order by its opaque access token (guest order access without a session). Optional email argument enables defense-in-depth: if provided, must match the order buyer email (case-insensitive); on mismatch the query returns null exactly like an invalid token. Rate-limited to 5 requests per minute per IP+shop. Response carries Cache-Control: no-store.

orderByToken(
  email: String
  token: String!
): Order

Arguments​

orderByToken.email ● String scalar​

Optional email guard (case-insensitive). When provided, must match the order buyer email; on mismatch returns null (same shape as invalid token). The storefront decides per threat model.

orderByToken.token ● String! non-null scalar​

Opaque access token from Order.accessToken

Type​

Order object​

A buyer order — the result of completing a cart. Carries totals, status, addresses, line items and the signals needed to drive payment (canCreatePayment, paymentMethodType) and a guest confirmation page (accessToken).