Appearance
Sign-up flow (web)
A new customer registers on the storefront and proves their email address. Two calls do it: register creates the account and emails a one-time code, and login with that code verifies the account and returns the customer token.
Play the flow
Two paths: the one that works, and the one the endpoint names suggest — verifying the code with verify-otp — which leaves the customer unable to log in with their password.
shop.example.com/
shop · rewards · scan
everything from batch, in one place
shop, scan a product, or check your rewards
log in
Page not designed yet — drawn from what the documented flow requires.
States
This journey is one path through the authentication statechart, which traces every edge to code.
The account itself moves from non_verified to verified on the login-with-OTP transition. The full account lifecycle, including the other ways to verify and how an account is closed, is under Lifecycle.
API calls by stage
| Stage | Action | API call | Access |
|---|---|---|---|
| 1 | Page loads | POST /api/v1/tenant — returns the brand key as result.apiKey | Origin |
| 2 | Create account | POST /api/v1/register — email or phoneNumber (+ phone_prefix); password optional | Origin + Brand key |
| 3 | Verify | POST /api/v1/login — the same identifier plus otp. Returns token | Origin + Brand key |
| 3′ | New code, if needed | POST /api/v1/send-otp | Origin + Brand key |
| 4 | Account page | GET /api/v1/user/detail | Origin + Brand key + Customer |
What the API forces onto this page
- Do not call
verify-otpto finish sign-up. It accepts the code and spends it, but leaves the accountnon_verifiedand returns no token. A password login is then refused, and the customer needs a new code. See Verify an OTP. - Registering twice fails.
registerrefuses any existing account with the same email or phone in the brand — verified or not — with User Already Exists. A customer who abandoned sign-up must log in with a fresh code instead, so the page should offer that rather than a second registration. - reCAPTCHA is conditional. On a website brand that is neither webflow nor marketplace,
loginandsend-otprequirerecaptcha_token. - A
+in an email is rejected, andphone_prefixbecomes required as soon asphoneNumberis sent. - Referral attribution rides on
loginas thereferralCodequery parameter; the loyalty profile is started on the same call for a loyalty brand.