Guest order lookup

Many stores let people order without signing up and later look the order up with order number + email or order number + mobile number. Guest order lookup adds that form to your hosted login page. Axowl proves the shopper owns the email or phone; your app decides whether that contact placed that order.

• No account is created. The shopper does not become an end user and does not count toward MAU.
• Axowl stores no order data. The order number and contact live in a short-lived link or code (10 min email, 5 min text, 90 s hand-off), nothing else.
• Plan: Pro+ and above. On a lower plan the switch cannot be turned on, and if you downgrade the form disappears on its own (your saved setting comes back when you upgrade).
• Texts cost credit. Each code sent by text is charged at the SMS rate to your organization’s prepaid credit. Email is free.

Turn it on

Dashboard → Applications → your app group → Login methods → Guest order lookup.

Then link to the hosted login page with the page that should show the order as redirect_url. That URL must be one of the application’s Callback URLs — without it the form stays hidden, because there is nowhere to send the result.

https://login.axowl.com/login/{applicationKey}?redirect_url=https://shop.example.com/orders/guest

Flow

By email

1. The shopper enters the order number and email on the hosted login page.
2. Axowl emails a link (valid 10 minutes, single use), branded with your app name.
3. The link opens the portal, which trades it for a one-time code and sends the shopper to redirect_url?guest_order_code=….

By text

1. The shopper enters the order number and mobile number (Korean local numbers like 010-… are accepted; others need +country).
2. Axowl texts a 6-digit code (valid 5 minutes) from your app name. US and Canadian numbers get “Reply STOP to opt out.”
3. The shopper types the code on the same page; the portal sends them to redirect_url?guest_order_code=….

Then, either way

4. Your server exchanges the code and gets back the confirmed contact and the order number. Do it in the request that receives ?guest_order_code= — the code lives 90 seconds and works once — then redirect to a clean URL so the code does not stay in browser history or leak through Referer.
5. Look the order up in your own database. Show it only if the order’s email (or phone) matches.

Endpoints — /api/public/apps/{applicationKey}/guest-order

Method · Route	Called by	Purpose
POST /send	Hosted portal	Email the confirmation link
POST /verify	Hosted portal	Link token → one-time code (90 s)
POST /sms/send	Hosted portal	Text a 6-digit code → { requestId } (billed per message)
POST /sms/verify	Hosted portal	{ requestId, code } → one-time code (90 s). 5 wrong tries ends the request
POST /exchange	Your server	One-time code → result below (single use)

send request body

Field	Meaning
email	Where the link is sent.
orderNumber	What the shopper typed, up to 64 characters. Shown in the email. Not checked by Axowl.
redirectUrl	Where the link lands — the portal’s /login/{applicationKey}/verify route. Same rules as magic link.
postSignInRedirectUrl	Your order page. Must match a registered Callback URL (exact or same origin).
turnstileToken	Cloudflare Turnstile token when bot protection is on.

sms/send request body

Field	Meaning
phone	E.164 (+821012345678) or a Korean local number (010-1234-5678). Only supported countries.
orderNumber	As above. Not included in the text.
turnstileToken	Cloudflare Turnstile token when bot protection is on.

Exchange the code (your server)

curl -X POST https://api.axowl.com/api/public/apps/$APP_KEY/guest-order/exchange \
  -H 'Content-Type: application/json' \
  -d '{"code":"<guest_order_code from the query string>"}'

{ "email": "[email protected]", "phone": null, "channel": "email", "orderNumber": "20261021-0042", "applicationKey": "client_…", "verifiedAt": "2026-10-21T09:12:03Z" }

channel is email or sms. Exactly one of email / phone (E.164) is filled.

Match the order yourself

Axowl only confirms that the person controls the email or phone. It does not know your orders. Always check order.email == result.email (case-insensitive) or order.phone == result.phone (compare in E.164) before showing anything. Otherwise anyone who can read their own inbox or texts could view any order number they guess.

Why the code travels in the query string

The hand-off is server-to-server by design: your server receives the landing request and exchanges the code, so a query parameter is what reaches it (a #fragment never leaves the browser). The code is random (48 hex), single-use, and expires in 90 seconds, so a copy left in a log or history is worthless once exchanged. Exchange it immediately and redirect; never render a page that still carries the code.

Errors

Status · code	When
400 GUEST_ORDER_DISABLED	Switch is off, or the org is below Pro+
400 INVALID_EMAIL / INVALID_PHONE / INVALID_ORDER_NUMBER	Empty, too long, unreadable, or control characters
400 SMS_REGION_NOT_SUPPORTED	The number’s country is not on the SMS list
400 TURNSTILE_REQUIRED	Bot protection is on and the token is missing or failed
400 GUEST_ORDER_WAIT	Same email or phone asked within the last minute
429 GUEST_ORDER_THROTTLED	Too many requests from one IP (5 per 10 min, 20 per day), one app group (120 per 10 min), or one phone (5 per day; fewer for higher-risk countries)
502 SMS_SEND_FAILED	The text could not be sent — including when the organization’s credit is empty (the owner gets an email)
400 GUEST_ORDER_CODE_INCORRECT	Wrong text code — attemptsLeft says how many tries remain
400 GUEST_ORDER_CODE_EXPIRED	Text code expired or used up — request a new one
400 on /verify	Link expired, already used, or issued for another application — the shopper requests a new one
404	Unknown applicationKey
401 on /exchange	Code expired (90 s), already used, or for another app
429 GUEST_ORDER_THROTTLED on /exchange	More than 600 exchange calls from one server IP in 10 minutes