Skip to content
EvolveEvolveEvolve

medusa-plugin-customer-lookup

@evolve-framework/medusa-plugin-customer-lookup · v1.0.0

Adds one Store API route to Medusa that tells whether an account exists for an email address, so a checkout can send a shopper to sign in or to register.

GET /store/customers/exists?email=someone@example.com
→ { "exists": true | false }

When to use

Install it when the storefront's checkout asks whether an email address already has an account. The Evolve Medusa adapter uses this route for Query.customerExists. Without the plugin that field reports NOT_AVAILABLE rather than guessing an answer.

Leave it out when the checkout does not need the answer: the route tells anyone which addresses are registered.

Get started

  1. Install the package with the peer dependencies it needs. It comes from the Evolve registry, which needs a one-time sign-in.

    pnpm add @evolve-framework/medusa-plugin-customer-lookup @medusajs/cli @medusajs/framework @medusajs/medusa
    Requirements4
    node>=20
    @medusajs/cli2.21.2
    @medusajs/framework2.21.2
    @medusajs/medusa2.21.2

For example:

// medusa-config.ts
import { defineConfig } from "@medusajs/framework/utils";


module.exports = defineConfig({
  // projectConfig, modules and other plugins as before
  plugins: [
    {
      resolve: "@evolve-framework/medusa-plugin-customer-lookup",
      options: {},
    },
  ],
});

Why this is a plugin and not part of the platform

Medusa deliberately does not answer this question on its Store API. An endpoint that does is an endpoint that lets anyone walk a list of addresses and learn which are registered. Installing this plugin is accepting that trade, so it is opt-in.

The reason to accept it is the checkout: telling a returning shopper to register, or a new one to log in, is the kind of dead end people abandon a cart over. So the route says as little as it can: one boolean, never a name or an id.

What it does not do

It does not rate limit. A publishable key is public in any storefront, so the caller cannot be identified at this layer; and in a normal deployment the only caller is the purchase subgraph, so a per-IP limit would spend the whole allowance on it and lock out every shopper while doing nothing about a distributed attempt.

Put a rate limit in front of Medusa, where real clients are visible. Stock Medusa treats its own auth endpoints the same way.