> ## Documentation Index
> Fetch the complete documentation index at: https://docs.marzipan.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Account From Order

> Turn a guest's order into an account by setting a password, from the order confirmation page. Requires the `confirmationToken` from the checkout response, which is only minted where there is something to offer. Succeeds only while the customer still has no password, which is what prevents a replay from overwriting live credentials. Signs the customer in and returns an access token.



## OpenAPI

````yaml /api-reference/openapi.json post /account/create-from-order
openapi: 3.0.0
info:
  title: Marzipan API
  version: 1.0.0
servers:
  - url: https://api.marzipan.co/v1
security:
  - tenantAuth: []
tags:
  - name: Account
    description: >-
      Account management endpoints including registration, login, and user
      details
  - name: Carts
    description: Shopping cart management endpoints
  - name: Products
    description: Product catalogue and search endpoints
  - name: Subscriptions
    description: Subscription management and renewal endpoints
  - name: CMS
    description: Content management system endpoints
  - name: Messaging
    description: Message and communication endpoints
  - name: Settings
    description: >-
      Storefront settings and market detection used to configure the web
      components and checkout.
  - name: Analytics
    description: Storefront visit and attribution tracking.
  - name: Rewards
    description: >-
      Loyalty and rewards programme endpoints for the authenticated customer,
      covering points balance, tier status, perks, exclusive products and
      transaction history.
  - name: Forms
    description: Render and submit dynamic storefront forms defined in the CMS.
  - name: Events
    description: >-
      Check event availability, browse occurrences and recurring dates, generate
      ticket QR codes, and manage event waitlists (join, leave, check status,
      and claim promoted spots).
paths:
  /account/create-from-order:
    post:
      tags:
        - Account
      summary: Create Account From Order
      description: >-
        Turn a guest's order into an account by setting a password, from the
        order confirmation page. Requires the `confirmationToken` from the
        checkout response, which is only minted where there is something to
        offer. Succeeds only while the customer still has no password, which is
        what prevents a replay from overwriting live credentials. Signs the
        customer in and returns an access token.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - token
                - password
              properties:
                token:
                  type: string
                  description: The `confirmationToken` from the checkout response.
                password:
                  type: string
                  minLength: 8
                  description: >-
                    At least 8 characters, with an uppercase letter, a lowercase
                    letter and a number.
      responses:
        '200':
          description: The account was created and the customer signed in.
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                  email:
                    type: string
                    format: email
                  token:
                    type: string
                    description: A customer access token, valid for one week.
              example:
                message: Account has been created. Please check your email.
                email: customer@example.com
                token: 12|AbCdEf...
        '422':
          description: The token has expired, or the customer already has a password.
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
components:
  securitySchemes:
    tenantAuth:
      type: http
      scheme: bearer
      description: >-
        Bearer authentication header of the form `Bearer <token>`, where
        `<token>` is your API token.
      bearerFormat: JWT

````