Customers and customer groups
A customer resource holds buyer identity and profile data. Customer groups provide a reusable segment that can participate in contextual price selection.
Customer data
Admin services can create and manage customers with email, name, marketing consent, metadata, metafields, and addresses. Use native fields for data Thor understands, metafields for typed project-specific data, and metadata for integration bookkeeping.
Email is the account identifier when present. Treat it as personal data: avoid copying it into logs or metadata, and keep access to Admin customer operations server-side.
Customer groups
A group has a name, optional description, and a customer membership list. Variant prices can be scoped with customerGroupId, allowing a signed-in customer’s group to affect price eligibility.
Use groups for stable commercial segmentation such as wholesale or contract pricing. Do not use a group as a substitute for arbitrary authorization roles; customer authentication and Admin authorization are separate concerns.
Admin and Storefront responsibilities
The Admin API supports operational customer management and customer-group maintenance. The Storefront API supports buyer-controlled registration, activation, sign-in, token refresh, password recovery, profile updates, and address management.
For account flows and token handling, see Customer authentication.
Guest and signed-in checkout
A cart can carry customerEmail without a customerId, which supports guest checkout. An authenticated flow can associate the customer identity with the cart. Keep the cart returned by each mutation because customer association can change pricing, discounts, or other eligibility.
Orders can also be associated with or detached from a customer through Admin mutations. Preserve the order’s own address and line snapshots for order processing; do not assume later profile edits rewrite historical order data.
Consent and custom data
Marketing consent appears on both customer and cart inputs. Capture the value explicitly and retain whatever legal evidence your own compliance policy requires outside the boolean field.
Use metafield definitions to establish the kind and ownership of customer custom fields before integrations depend on them.