Account, settings, and security

Your app can use the SDK for account-related backend features while keeping its own interface and local preferences.

Profile and session#

const signedIn = await sdk.auth.login({
  email: 'buyer@example.com',
  password: 'use-your-secret-manager',
});

// CartSDK now uses this access token for authenticated requests.
const currentAccount = await sdk.auth.verifySession();
await sdk.account.listOrders(signedIn.admin._id, { page: 1, limit: 20 });

Use sdk.auth.refresh(refreshToken) when your app's session policy says the access token should be refreshed. sdk.auth.logout() calls the server and clears the SDK's active token after a successful response.

Account security#

The sdk.auth client includes password reset validation, password reset, password change, two-factor setup/confirmation/disable, and account deactivation/deletion. Verify the signed-in identity and ask for appropriate user confirmation in your application before sensitive actions.

Notification settings and self-hosted notification topics have backend operations as well:

const preferences = await sdk.settings.notificationPreferences(userId);
await sdk.settings.updateNotificationPreference(userId, 'orders', true);
const notificationConfig = await sdk.settings.selfHostedNotificationConfig(userId, storeId);

Preferences belong to your app#

The website currently keeps display language, display currency, marketing-email preference, and some notification toggles in client-side Redux state. They do not all have matching backend mutations. The SDK deliberately leaves preference persistence to the consuming application rather than implying that an unpersisted local preference was saved on the server.

Currency selection for a request that supports it can be supplied as currencyCode or x-payment-currency; it does not change the platform's primary ZAR currency or replace backend payment validation.