Signed customer identity and "My orders"

1.5.0 (unreleased). Nothing on this page is published or deployed. It describes the code on branch feat/magento-1.5.0-customer-hub and its module / UI branches as read on 2026-09-27. Tested end to end on Magento 2.4.7-p4, 2.4.7-p9 and 2.4.8-p5 — Luma and the Hyvä theme (2.4.7-p9), with the built-in page cache, Varnish and Redis — against the real Conviro API in a real browser (2026-09-27/28); Hyvä Checkout and other versions are not tested yet (Supported versions). Where a part is designed but not built, the section says so.

A shopper who is signed in to your Magento store can ask the chat "show my orders" and see their own orders at once — without typing an order number or an e-mail address — because your store proves to Conviro, with a short-lived signature, which customer is chatting. A guest, or a shopper Conviro could not verify, never sees anyone's orders this way; they keep today's order lookup.

What it does

1. The shopper is signed in to your store and opens the chat.
2. The widget asks Conviro for a one-time challenge, then asks your store (GET /conviro/identity/bootstrap, same origin, never cached) to sign it. Your store checks its own customer session and answers with a 60-second Ed25519 signature over the customer id and the store view — no name, no e-mail.
3. Conviro checks the signature with the public key your store registered, spends the challenge once, and creates a Verified Customer Principal for that chat: at most 15 minutes, then the widget quietly repeats step 2 while the shopper is still signed in.
4. When the shopper asks for their orders (the My orders chip, or typing e.g. "my orders", "where is my order", "siparişlerim", "meine Bestellungen", "mijn bestellingen"), Conviro asks your store through a read-only route that re-checks the signed session on every call and returns only that customer's orders.

The name the widget greets a shopper with still comes from the storefront's customer section. It is display only: it never opens an order, and neither does an e-mail or customer id a page passes to the widget.

The four identity states

Short-lived states on top of these: session expired (the 15 minutes ran out — the widget reconnects silently; if that fails the order card says "Your secure connection to the store has expired" with Reconnect), signed out (the shopper signed out in this or another tab — every order card disappears at once, then "You've signed out"), account switched (another customer signed in on the same browser — the previous customer's cards are removed before anything else is shown), and store unavailable ("We can't reach the store right now — please try again"). None of them is ever shown as "no orders".

A store where the feature is off at any point — module below 1.5.0, a switch off on either side, no registered key, an old widget build — behaves exactly as 1.4.x: the greeting, the chat and the guest order lookup are unchanged, and the widget shows no "connecting" message.

What a signed-in shopper sees

• A My orders chip in the chat once they are verified and My orders is on. (Only this one shortcut exists; the product plan's other quick actions — Where is my parcel?, Return / exchange, Product advice — are not built. Typing works for tracking.)
• While someone from your team has taken over the chat, order requests go to them as ordinary messages; the chat itself answers with order cards only while the bot is handling it.
• Your recent orders: up to 5 orders, newest first, then Show more. Each card: order number, date, the status label your storefront shows, total in the order's currency, up to 3 item names with quantities ("+N more"), shipment status (Not shipped yet, Partly shipped, Shipped, No shipping needed), and the buttons Track (when shipped), All orders (your store view's My Orders page, new tab) and Ask about this order / Talk to a person.
• Track shows the order with its carriers and tracking numbers (up to 20 items). Asking "where is my order" picks the one shipped order, or asks "Which order would you like to track?" when several are shipped, or says "None of your recent orders has shipped yet."
• A typed order number of the shopper's own account opens that order; any other number gets "We couldn't find that order in your account" — the same answer whether the order exists, belongs to someone else, is in another store view or has a status your storefront hides. A verified shopper is never asked for their checkout e-mail.
• Free questions about their orders ("why is it late?") are answered by the AI from a freshly read copy of the same data; a value the store did not give (e.g. no tracking yet) is said to be unknown, never guessed.
• Order views that are not an empty list: loading (skeleton), store unavailable (Try again), too many requests (try again in a minute), not in this account, connection expired (Reconnect), signed out (Sign in), not available in the chat for this store (All orders and the guest lookup hint). "You have no orders in this store yet." appears only when your store answered and the list is empty.
• Dates and amounts are formatted in the widget's language; the status label is your store view's own. Widget texts exist in 29 languages (machine-translated on 2026-09-27, native-speaker review still open).

Only statuses your storefront's own My Orders page shows are listed (Magento's "visible on front" statuses).

What is never shown

To the shopper, in the chat: the billing or shipping address, telephone, the customer's e-mail or name from the order, payment method or payment details, item prices, discounts and coupon codes, invoice and credit memo numbers, the customer note and gift message, and Magento's tracking-popup link (a link anyone could open). Magento's route never sends them; Conviro drops any field it does not expect.

To your team and your integrations: a verified shopper's free-text order answers are stored sealed — the inbox shows "Verified customer order answer — visible only to the customer", and webhooks (message.new), the public API, exports and every other reader get the placeholder [Verified customer order answer: shown only to the signed-in customer] instead of the text. Order cards themselves are never stored. When the shopper taps Ask about this order, the agent who takes over sees only that one order, masked: number, status, dates, total, number of items, shipment status and number of tracking entries — no item names, no tracking numbers, no customer data. That context is kept 30 days.

To anyone after the shopper: after a sign-out or an account switch on the same device, the widget starts a new chat, and earlier order answers are hidden from whoever reads the old chat. What the shopper typed themselves (for example an order number) stays in the transcript as it does today.

How to enable

Everything is off by default, on both sides. Upgrading to 1.5.0 changes nothing for shoppers until both your store and Conviro switch it on (Upgrade 1.4 → 1.5).

Prerequisites

• Module 1.5.0 or later, and a Conviro backend that supports it. An older backend makes the admin say "the Conviro backend does not support it yet"; everything else keeps working.
• The store is connected with Magento OAuth 1.0a (Integration Health › Authentication row = Pass). My orders refuses the legacy bearer connection.
• The store views your shoppers sign in to are selected in the setup wizard (step 4) and known to Conviro. A store view Conviro has no mapping for is refused, so nobody there is ever verified.
• PHP's sodium extension (ext-sodium; Composer refuses to install 1.5.0 without it).
• The storefront is served over https.
• Magento cron runs (sign-out and account-switch notices reach Conviro through the event queue).
• The API key was created by the setup wizard's Connect to Conviro (scope magento:module). A hand-pasted key without that scope cannot register the identity key.

At Conviro (you cannot switch these yourself)

Ask Conviro support to switch them on for your workspace. Switching one off again takes effect within about a minute (the flag is cached for 60 seconds): every private read re-checks it, and live verifications of that workspace are revoked.

In Magento

Stores › Configuration › Conviro › AI Chat › Signed Customer Identity (beta), per website. Changing these needs the Conviro Setup permission.

Full list: Configuration reference.

Steps

1. Ask Conviro to switch on magento_identity_bridge (and magento_my_orders) for your workspace.
2. In Magento, set Enable signed customer identity = Yes (and Show verified shoppers their own orders = Yes) for the website, Save Config.
3. Open Stores › Settings › Conviro Setup (or the same card at the top of the Signed Customer Identity group): the Customer Experience & Identity card should say the key is registered, Conviro should say the feature is on, and no Permissions warning should be shown.
4. Click Test identity bridge for a store view. It signs a synthetic assertion — no real customer, nothing written — and Conviro checks it without creating anything. Every step should be green. (Conviro allows 10 tests an hour per store.)
5. Sign in as a test customer on the storefront, open the chat, tap My orders.

If a step fails: the Customer identity runbook (the 30-second check) and Troubleshooting.

Talking to a person about an order

Talk to a person is on every order view when your chatbot allows handoff; when it does not, the button becomes Contact the store (a link to your store), never a dead button. Ask about this order on a card hands the chat to your team with that one order attached (masked, see above). A handoff is never refused because of identity: if the order cannot be read at that moment, the chat is handed over without it and the agent sees "Store unreachable at handoff".

Guest verification (designed, not built)

Planned for 1.5.0 but not built at Conviro on 2026-09-27: when on (the Magento switch above and magento_guest_otp at Conviro), a guest who gives an order number and checkout e-mail first receives a 6-digit code at that address and sees the order only after typing it in the chat (code valid 10 minutes, 5 attempts; the answer never says whether the order exists). The code opens that one order for 15 minutes and is never enough to change it. Until it ships, guests look orders up as today (order number + checkout e-mail, with the existing limit of 5 misses an hour).

Order actions by verified shoppers (designed, not built)

Planned: a verified shopper may request a cancellation, return, exchange or address change from an order card; your team approves every such request in 1.5.0 (Conviro dashboard › Inbox › Approvals). Only with Order-action assistance on (capabilities/allow_order_actions, off by default) may Conviro then write the approved change to your store; otherwise it becomes a task for your team. 1.5.0 adds no Magento write route and no write permission. Not built on 2026-09-27.

In the Conviro dashboard

The Magento store card gains a Customer identity section: whether each switch is on, the key state and age, the last successful verification, the store-view mapping, warnings with the fix, and figures for the last 7 or 30 days — share of chat conversations that were verified, verifications that succeeded / failed by reason, My orders taps and typed requests, order reads (loaded, empty, unavailable, refused), the estimated p95 read time and handoffs with / without an order. Only counts are kept — no customer, session or order id (Privacy).

Switching it off

• Set the Magento switches back to No and Save Config: the store stops signing at once (the bootstrap answers 404), and the next registration withdraws the order-read permission.
• Or ask Conviro to switch the platform flag off: live verifications end within about a minute, the widget falls back to the guest lookup.
• Downgrading the module to 1.4.x also works: its registration no longer announces the feature and Conviro revokes the store's identity keys. The module's table conviro_identity_binding stays, unused.

Related pages

Security model · Privacy and field inventory · Permissions · Integration Health · Multi-store · Headless, PWA and Hyvä · Customer identity runbook · Release notes 1.5.0 (draft)