---
name: account-and-checkout
description: Create or use a buyer's account and take a cart through checkout with the buyer's approval
version: 1.0.0
---

# Account and checkout

Act only for a buyer who asked you to. The buyer approves every purchase.

## Do you need an account?

Usually not. This store supports guest checkout, which is the shortest path.
Create an account only if the buyer wants one for order history.

## Creating an account

Use the registration form on `/my-account/` in the buyer's browser session.
Keep its cookies and hidden nonce, and submit using the Register button.

- Fill only visible fields. Leave the hidden `Company fax` field empty: it is a
  spam trap, and filling it refuses the registration.
- Depending on the store, the form asks for a password or emails the buyer a
  link to set one. Only the buyer should read that email. Do not ask for
  access to their inbox.
- Use the buyer's own email address, never an invented or someone else's.
- An email already on file is not access to that account. Ask the buyer to sign
  in, or to use the password-reset link. Do not guess passwords.

## Checking out

1. Add the items to the cart, and let the store calculate price, shipping and tax.
2. Show the buyer the items, delivery address and final total.
3. Hand over to the buyer for payment. Card, bank and wallet approval belongs to
   the buyer. Never enter or store their card details for them.
4. Confirm the order result page. Treat an unclear payment as unresolved: do not
   create a second order to get past a timeout.

A headless `Cart-Token` cart does not open in another browser, so build the cart
in the buyer's browser whenever the buyer will pay there.

## When the store refuses a request

Limits protect buyers from spam. There is no exemption for agents, so do not
rotate addresses or switch routes to get around them.

- HTTP `429`, or a "too many attempts" message: stop. Honor `Retry-After` if it
  is present; otherwise wait at least ten minutes for checkout, and an hour for
  registration.
- "Registration is busy": offer guest checkout instead.
- HTTP `5xx` or a "try again shortly" message: wait a few minutes, once.

If you still cannot complete the order, send the buyer to `/contact/`.