Skip to main content

Account

The sdk.account module exposes the storefront customer account: reading the current session, logging in, and requesting a password reset.

Handle credentials with extreme care

account.login transmits a password. Only ever read it from a field the customer just typed, over HTTPS, and never store, log, cache, or forward it. Prefer the platform's own account flows where you can. See safe usage below.

getUserInfo()​

Returns the currently logged-in customer, or a logged_in: false marker if there is no session.

const info = await sdk.account.getUserInfo();
if (info.logged_in) {
    console.log(`Hello, ${info.user.first_name}`);
} else {
    showLoginButton();
}

login(email, password)​

Authenticates a store customer and establishes a session. Returns the customer on success, or an error response with HTTP 401 on invalid credentials.

try {
    const result = await sdk.account.login(email, password);
    if (result.status === 'success') {
        window.location.reload();
    }
} catch (err) {
    // 401 invalid credentials, or 429 if attempts are throttled
    showError('Login failed.');
}

resetPassword(email)​

Requests a password-reset email. For privacy, the response is the same whether or not an account exists.

await sdk.account.resetPassword(email);
showMessage('If an account exists, a reset link has been sent.');

Rate limiting​

Account endpoints carry an extra, stricter throttle on top of the generic SDK limiter: login and reset attempts are limited per IP and per email address. Once the limit is reached, further attempts return HTTP 429 (surfaced as a rejected promise) until the window resets. This protects your customers against credential stuffing.

Surface throttling to the user

On a 429, show a friendly "too many attempts, please try again later" message rather than retrying automatically.

Safe usage​

  • Do read the password only from the customer's own input, immediately before calling login.
  • Do show clear feedback for 401 (bad credentials) and 429 (throttled).
  • Don't persist the password in a variable, localStorage, a cookie, or a log.
  • Don't build a "remember my password" feature — store the session, never the secret.
  • Don't call login speculatively or in a loop.