Works on your phone. Best experienced on a desktop.
Browseryour customerDNSname → IPWeb serverBackend + APIDatabase
Phase 3 · Give customers accounts

Orders need an owner.

Carts, addresses, order history, all of it belongs to a specific person. The system has to know who is asking, and prove it, before it hands over anything personal.

Two different questions are hiding here: who are you, and what are you allowed to do.

Phase 3 · Give customers accounts

Prove it, then remember it.

Authentication proves who you are, checking a password the server never actually stores in the clear. Then sessions and tokens let the server remember you across every following click without asking again.

New in your architecture
AuthenticationAuthorizationPassword hashingSessionCookiesAccess and refresh tokensOAuth / "Login with Google"
Phase 3 · Give customers accounts

Now protect it.

Accounts attract abuse. Rate limiting stops password-guessing, a second factor limits stolen-password damage, roles decide who can do what, and everything personal is now data you are legally and ethically responsible for.

New in your architecture
Roles and permissionsOTP and two-factor authenticationRate limiterEncryption at rest and in transitPII (personal data)
State of your product
Where TiffinBox stands after Phase 3.

You worked through Phase 3: give customers accounts. 12 new concepts joined your architecture along the way.

Next problem: You cannot build a bank. Money moves safely through other people's systems.