> Documentation index: [Saleor](/llms.txt) · [This section](/developer/llms.txt)
> Source: https://docs.saleor.io/developer/users/customer-account
# Manage Account as a Customer
This guide describes how to use the Saleor GraphQL API to register a new account as a customer and do everyday account management operations.
Saleor does not send these emails itself. Install [Customer Emails](/developer/app-store/apps/customer-emails/overview.md) on Saleor Cloud, or the [SMTP app](/developer/app-store/apps/smtp/overview.md) if you are self-hosting (or another app subscribed to the account events).
## Multiple channels and users
Creating a new account requires specifying a channel. It is needed because you can use different communication strategies for each channel (means of contact, templates used, etc.).
User accounts are not restricted to a single channel. So, for example, a user registered in the `europe` channel can still log in and place an order through the `usa` channel.
## Creating a new customer account
Depending on the configuration of your Saleor backend instance, registering a new customer account may be a single-step operation, or it may require email confirmation when the flag [`enableAccountConfirmationByEmail`](/api-reference/miscellaneous/objects/shop.md#enable-account-confirmation-by-email) is set to `True` When `enableAccountConfirmationByEmail` is set to `True` you can now configure one of the following flows by setting a flag [`allowLoginWithoutConfirmation`](/api-reference/miscellaneous/objects/shop.md#allow-login-without-confirmation):
- allow users to log in without email confirmation
- users can only log in after confirming their email
```mermaid
graph TD
R([Register an account]) --> CR{Confirmation by email enabled?}
CR -->|No| A([New account is active])
CR --> |Yes| AL{Allow to log in without confirmation?}
AL --> |Yes| ANC([New account is active but not confirmed])
CR -->|No| E[Ask user to check their email]
E -.-|User clicks link with token| CA[Confirm account using token]
CA --> C([New account is confirmed])
C --> A
ANC --> E
```
### Previous orders
When an account is confirmed, existing anonymous orders using the same email address are automatically assigned to the new account.
### Registration without email confirmation
To create a new customer account, use the [`accountRegister`](/api-reference/users/mutations/account-register.md) mutation. The mutation takes the following input fields:
- `email`: user's email address.
- `password`: user's password.
- `channel`: the slug of the channel used to sign up.
**Mutation**
```graphql
mutation AccountRegister($input: AccountRegisterInput!) {
accountRegister(input: $input) {
errors {
field
code
}
user {
email
isActive
isConfirmed
}
}
}
```
**Variables**
```json
{
"input": {
"email": "customer@example.com",
"password": "secret",
"channel": "default-channel"
}
}
```
**Result**
```json
{
"data": {
"accountRegister": {
"errors": [],
"user": {
"email": "customer@example.com",
"isActive": true,
"isConfirmed": false
}
}
}
}
```
The [`isActive`](/api-reference/users/objects/user.md#is-active) flag informs that the account is active. If `active` is set to `False` the user can never log in.
The [`isConfirmed`](/api-reference/users/objects/user.md#is-confirmed) flag set to `false` means that the account was not confirmed. When you have disabled [`enableAccountConfirmationByEmail`](/api-reference/miscellaneous/objects/shop.md#enable-account-confirmation-by-email), `isConfirmed` doesn't hold any meaning for users, they are treated as confirmed. The only difference is that in the confirmation flow, the user can get access to past orders, see [Previous orders](#previous-orders).
Examples above include `errors` field, which may return any [data-level errors](/api-usage/error-handling.md#data-level-errors). Here is a response that would be returned if there is already an account registered for the given email:
```json
{
"data": {
"accountRegister": {
"errors": [
{
"field": "email",
"code": "UNIQUE"
}
],
"user": null
}
}
}
```
### Registration with email confirmation
Registering an account with email confirmation consists of two steps, and it requires you to have a storefront view, where users will be redirected to confirm their email. First, you need to use the [`accountRegister`](/api-reference/users/mutations/account-register.md) mutation to create an inactive account and send an email with the confirmation link. The mutation takes the following input fields:
- `email`: user's email address.
- `password`: user's password.
- `redirectUrl`: path to a view where the user should be redirected to confirm their email.
- `channel`: the slug of the channel used to sign up.
This example assumes that you're running the storefront locally with the default settings (running on port `3001`):
**Mutation**
```graphql
mutation RegisterWithConfirmation($input: AccountRegisterInput!) {
accountRegister(input: $input) {
errors {
field
code
}
user {
email
isActive
isConfirmed
}
}
}
```
**Variables**
```json
{
"input": {
"email": "customer@example.com",
"password": "secret",
"channel": "default-channel",
"redirectUrl": "http://localhost:3001/account-confirm/"
}
}
```
**Result**
```json
{
"data": {
"accountRegister": {
"errors": [],
"user": {
"email": "customer@example.com",
"isActive": true,
"isConfirmed": false
}
}
}
}
```
At the same time, the user `customer@example.com` should receive an email with a confirmation link based on the provided `redirectUrl` path, for example:
```text
http://localhost:3001/account-confirm/?email=customer%40example.com&token=5fc-9f2116f96bdafd612cf4
```
The link contains two query parameters—`email` and `token` — which are required to proceed with the second mutation, [`confirmAccount`](/api-reference/users/mutations/confirm-account.md):
**Mutation**
```graphql
mutation ConfirmAccount($email: String!, $token: String!) {
confirmAccount(email: $email, token: $token) {
errors {
field
code
}
user {
email
isActive
isConfirmed
}
}
}
```
**Variables**
```json
{
"email": "customer@example.com",
"token": "5fc-9f2116f96bdafd612cf4"
}
```
**Result**
```json
{
"data": {
"confirmAccount": {
"errors": [],
"user": {
"email": "customer@example.com",
"isActive": true,
"isConfirmed": true
}
}
}
}
```
## Re-requesting email confirmation
Resending email confirmation requires you to have a storefront view, where users will be redirected to confirm their email. You need to use the [`sendConfirmationEmail`](/api-reference/users/mutations/send-confirmation-email.md) mutation to send an email with the confirmation link. The mutation takes the following input fields:
- `redirectUrl`: path to a view where the user should be redirected to confirm their email.
- `channel`: the slug of the channel used to sign up.
This example assumes that you're running the storefront locally with the default settings (running on port `3001`):
**Mutation**
```graphql
mutation SendConfirmationEmail($channel: String!, $redirectUrl: String!) {
sendConfirmationEmail(redirectUrl: $redirectUrl, channel: $channel) {
errors {
field
code
}
}
}
```
**Variables**
```json
{
"redirectUrl": "http://localhost:3001/account-confirm/",
"channel": "default-channel"
}
```
This mutation requires the caller to be [authenticated](/api-usage/authentication.md).
At the same time, the authenticated user should receive an email with a confirmation link based on the provided `redirectUrl` path, for example:
```text
http://localhost:3001/account-confirm/?email=customer%40example.com&token=5fc-9f2116f96bdafd612cf4
```
The link contains two query parameters—`email` and `token` — which are required to proceed with the second mutation, [`confirmAccount`](/api-reference/users/mutations/confirm-account.md):
**Mutation**
```graphql
mutation ConfirmAccount($email: String!, $token: String!) {
confirmAccount(email: $email, token: $token) {
errors {
field
code
}
user {
email
isActive
isConfirmed
}
}
}
```
**Variables**
```json
{
"email": "customer@example.com",
"token": "5fc-9f2116f96bdafd612cf4"
}
```
**Result**
```json
{
"data": {
"confirmAccount": {
"errors": [],
"user": {
"email": "customer@example.com",
"isActive": true,
"isConfirmed": true
}
}
}
}
```
## Resetting the password
info
The `requestPasswordReset` and `setPassword` mutations are blocked when [`passwordLoginMode`](/api-usage/authentication.md#password-login-mode) is set to `DISABLED`.
Resetting the password is a two-step operation. First, you need to call [`requestPasswordReset`](/api-reference/users/mutations/request-password-reset.md) mutation to send an email with a unique link to reset the password.
The mutation takes the following input fields:
- `email`: user's email address.
- `redirectUrl`: path to a view where the user should be redirected to reset the password.
- `channel`: Slug of a channel which will be used to notify the user.
**Mutation**
```graphql
mutation RequestPasswordReset($email: String!, $redirectUrl: String!, $channel: String) {
requestPasswordReset(
email: $email
redirectUrl: $redirectUrl
channel: $channel
) {
errors {
field
code
}
}
}
```
**Variables**
```json
{
"email": "customer@example.com",
"redirectUrl": "http://localhost:3001/reset-password/"
"channel": "default-channel"
}
```
As a result, if there are no errors in the response, the system sends an email to `customer@example.com` with a link to provide a new password, for example:
```text
http://localhost:3001/reset-password/?email=customer%40example.com&token=5fc-9f2116f96bdafd612cf4
```
The link contains two query parameters—`email` and `token`—which are required to proceed with the second mutation, [`setPassword`](/api-reference/users/mutations/set-password.md).
The mutation takes the following input fields:
- `token`: a unique token that was included in the link in the email.
- `email`: user's email address.
- `password`: the new password.
**Mutation**
```graphql
mutation SetPassword($email: String!, $password: String!, $token: String!) {
setPassword(email: $email, password: $password, token: $token) {
errors {
field
code
}
}
}
```
**Variables**
```json
{
"token": "5fc-9f2116f96bdafd612cf4",
"email": "customer@example.com",
"password": "new-secret"
}
```
If there are no errors in the response, the password is successfully changed.
## Changing the password
info
The `passwordChange` mutation is blocked when [`passwordLoginMode`](/api-usage/authentication.md#password-login-mode) is set to `DISABLED`.
If you wish to change your password as an authenticated customer, use the [`passwordChange`](/api-reference/users/mutations/password-change.md) mutation. The mutation takes the following input fields:
- `oldPassword`: the current user's password.
- `newPassword`: the new password.
**Mutation**
```graphql
mutation PasswordChange($oldPassword: String, $newPassword: String!) {
passwordChange(oldPassword: $oldPassword, newPassword: $newPassword) {
errors {
field
code
}
}
}
```
**Variables**
```jsom
{
"oldPassword": "secret",
"newPassword": "new-secret"
}
```
If no errors are returned, the password has been changed successfully.
This mutation requires the caller to be [authenticated](/api-usage/authentication.md).
## Changing the email address
Changing the email address of the existing user accounts is a two-step operation. First, you need to call the [`requestEmailChange`](/api-reference/users/mutations/request-email-change.md) mutation.
The mutation takes the following input fields:
- `newEmail`: the new email address to set for the account.
- `password`: the current user's password.
- `redirectUrl`: path to a view where the user should be redirected to confirm the new email address.
**Mutation**
```graphql
mutation RequestEmailChange($newEmail: String!, $password: String!, $redirectUrl: String!) {
requestEmailChange(
newEmail: $newEmail
password: $password
redirectUrl: $redirectUrl
) {
errors {
field
code
}
user {
email
}
}
}
```
**Variables**
```json
{
"newEmail": "new-address@example.com",
"password": "secret",
"redirectUrl": "http://localhost:3001/confirm-email/"
}
```
**Result**
```json
{
"data": {
"requestEmailChange": {
"errors": [],
"user": {
"email": "admin@example.com"
}
}
}
}
```
The confirmation links include an additional query-string parameter `token` which is required to confirm the operation, e.g.:
```text
http://localhost:3001/confirm-email/?token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE1ODYxNzY5OTQsIm9sZF9lbWFpbCI6ImFkbWluQGV4YW1wbGUuY29tIiwibmV3X2VtYWlsIjoibmV3LWFkZHJlc3NAZXhhbXBsZS5jb20iLCJ1c2VyX3BrIjoyMX0.aGAo28Ss_zOn_TwAzLCXdY1xENpf_-uw2khORoodKR8
```
To confirm the operation, we need to use the [`confirmEmailChange`](/api-reference/users/mutations/confirm-email-change.md) mutation, which accepts the following input:
- `token`: a unique token that was included in the link in the email.
**Mutation**
```graphql
mutation ConfirmEmailChange($token: String!) {
confirmEmailChange(token: $token) {
errors {
field
code
}
user {
email
}
}
}
```
**Variables**
```json
{
"token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE1ODYxNzY5OTQsIm9sZF9lbWFpbCI6ImFkbWluQGV4YW1wbGUuY29tIiwibmV3X2VtYWlsIjoibmV3LWFkZHJlc3NAZXhhbXBsZS5jb20iLCJ1c2VyX3BrIjoyMX0.aGAo28Ss_zOn_TwAzLCXdY1xENpf_-uw2khORoodKR8"
}
```
**Result**
```json
{
"data": {
"confirmEmailChange": {
"errors": [],
"user": {
"email": "new-address@example.com"
}
}
}
}
```
Both mutations require the caller to be [authenticated](/api-usage/authentication.md).
## Deleting the account
If you wish to remove your own customer account, you can do so by using two mutations. First, you need to request to delete your account with the [`accountRequestDeletion`](/api-reference/users/mutations/account-request-deletion.md) mutation. This mutation takes the following input:
- `redirectUrl`: path to a view where the user can confirm deleting the account.
**Mutation**
```graphql
mutation AccountRequestDeletion($redirectUrl: String!) {
accountRequestDeletion(redirectUrl: $redirectUrl) {
errors {
field
message
code
}
}
}
```
**Variables**
```json
{
"redirectUrl": "http://localhost:3001/confirm-delete/"
}
```
As a result, if there are no errors, the user receives an email with a link to confirm deleting their account. The link includes the `token` query parameter that is required in the second mutation:
```text
http://localhost:3001/confirm-delete/?token=5ff-b5818345d8b64331b068
```
To confirm deleting the account, use the [`accountDelete`](/api-reference/users/mutations/account-delete.md) mutation which accepts the following input:
- `token`: a unique token that was included in the link in the email.
**Mutation**
```graphql
mutation AccountDelete($token: String!) {
accountDelete(token: $token) {
errors {
field
message
code
}
}
}
```
**Variables**
```json
{
"token": "5ff-b5818345d8b64331b068"
}
```
As a result, the account is now deleted.
Both mutations require the caller to be [authenticated](/api-usage/authentication.md).
## Managing Your Addresses
You can manage addresses using the following mutations:
- [`accountAddressCreate`](/api-reference/users/mutations/account-address-create.md): Add a new address.
- [`accountAddressUpdate`](/api-reference/users/mutations/account-address-update.md): Update an existing address.
- [`accountAddressDelete`](/api-reference/users/mutations/account-address-delete.md): Remove an address from your account.
note
Updating or deleting an address does **not** affect addresses stored on previous orders. This ensures historical accuracy for invoices and fulfillment.
### Setting Default Addresses
You can set a default shipping or billing address using the [`accountSetDefaultAddress`](/api-reference/users/mutations/account-set-default-address.md) mutation.