Customer accounts and addresses

Customer authentication uses secure platform cookies. Themes display account UI and call approved actions; they never read a login cookie or store an authentication token.

Use sendThemeAccountCode and verifyThemeAccountCode for the supported sign-in flow, plus the public logout action. Use prepared helpers such as createThemeAccountAddressFormView, getThemeAccountAuthFormProps, getThemeAccountFieldProps, getThemeAccountActionProps, getThemeAccountAddressFormProps and getThemeAccountAddressSaveProps to connect custom markup.

The platform owns CSRF protection and request scope. Do not add an Authorization header or hand-build a customer endpoint.

Test signed-out, code-sent, invalid-code, signed-in, empty-address, create-address, edit-address and failure states. Labels and validation messages must remain readable on mobile and must not expose raw framework errors.