Photo: free stock photography (Unsplash licence) — see imprint
The context token is the session
The Store API is stateless for you but stateful for the cart: everything hangs off the context token. Lose it and the customer's basket vanishes. Persist it properly, refresh it on login, and never leak it into a URL.
The cart lives on the server — trust it
Do not calculate prices or totals in your frontend to make the UI feel fast. Show the server's numbers. Two systems computing the same total is how a customer sees €99 and gets charged €102.
Search criteria are your query language
Filters, aggregations, associations and sorting all travel in the criteria object. Learn it properly once — it is the same concept in the Store API, the Admin API and the DAL, and it will save you from fetching a whole catalogue to count three things.
Cache what is public, never what is personal
The category listing for an anonymous visitor is cacheable at the edge. The same listing for a logged-in B2B customer contains their prices and must never touch a shared cache. Get this boundary wrong once and you will leak pricing between customers.
- Everything hangs off the context token.
- Never recalculate the cart in the frontend.
- Personalised responses must never hit a shared cache.
Frequently asked questions
It is the session under another name. The Store API is stateless for you but stateful for the cart, and the context token is what ties a visitor to their basket, their language, their currency and their prices. Persist it properly, refresh it on login, and never let it end up in a URL where it can be shared, logged or pasted into a support ticket.
Almost always the context token. If it is not persisted across page loads, or a fresh one is issued at login without carrying the guest cart over, the basket is still sitting on the server — the customer just lost the key to it. Check where you store the token and what happens to it during login before you look anywhere else.
Don't. The cart lives on the server, and the server's numbers are the ones the customer is actually charged. The moment two systems compute the same total they will disagree — over a rounding rule, a tax rate or a B2B discount — and the customer sees one price and pays another. Show what the server returns, even when it costs you a round trip.
For public responses, yes — an anonymous category listing is a good edge-cache candidate. For anything personal, no. That same listing for a logged-in B2B customer carries their negotiated prices and must never touch a shared cache. Get the boundary wrong once and you leak one customer's pricing to another. Make the rule explicit in code, not in a comment.
We do this for a living — Shopware, Node.js, React, ERP integration and automation for B2B.
Talk to an engineer