Save session ids on orders

Save the session id and visitor id on each order in your shop system. Then every order, even one paid later or refunded, can be linked to the visit it came from.

Both are random UUIDs, such as 01a110c8-f11a-70cf-96bc-2210bd7dc587. We suggest two order fields, qm_session_id and qm_visitor_id, left empty when there is no id.

In the browser

Ask the script for the ids when the buyer places the order, and send them with it:

qm("ids", (ids) => {
  // ids: { sessionId, visitorId, stored } or null
  document.querySelector("#qm_session_id").value = ids?.sessionId ?? "";
  document.querySelector("#qm_visitor_id").value = ids?.visitorId ?? "";
});

<form method="post" action="/checkout/place-order">
  <!-- … the checkout fields … -->
  <input type="hidden" id="qm_session_id" name="qm_session_id" />
  <input type="hidden" id="qm_visitor_id" name="qm_visitor_id" />
</form>

Or, when your checkout sends the order with fetch:

function quomerceIds() {
  return new Promise((resolve) => {
    // Never let tracking hold up an order: give up after a moment.
    const timer = setTimeout(() => resolve(null), 500);
    qm("ids", (ids) => {
      clearTimeout(timer);
      resolve(ids);
    });
  });
}

const ids = await quomerceIds();
await fetch("/api/orders", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    ...order,
    qm_session_id: ids?.sessionId ?? null,
    qm_visitor_id: ids?.visitorId ?? null,
  }),
});

• Ask when the order is placed, not when checkout opens. A session ends after 30 minutes without activity.
• ids is null when the script is not running.
• stored says whether the ids are also in cookies. Without consent they are not, but they still work for the order.

On your server

With consent, or when your site does not ask for it, the ids are also in two first-party cookies, so your server can read them:

Cookie	Contents
_qm_sid	The session id
_qm_vid	The visitor id

// PHP, for example in WooCommerce's woocommerce_checkout_create_order hook
$order->update_meta_data('qm_session_id', sanitize_text_field($_COOKIE['_qm_sid'] ?? ''));
$order->update_meta_data('qm_visitor_id', sanitize_text_field($_COOKIE['_qm_vid'] ?? ''));

// Node.js, any framework that parses cookies
order.qm_session_id = req.cookies._qm_sid ?? null;
order.qm_visitor_id = req.cookies._qm_vid ?? null;

Uwaga

The cookies are missing without consent, and on the first page of a visit before the script runs. Prefer the browser ids, and fall back to the cookies.

If the checkout is on another subdomain, such as checkout.example.com, set cookieDomain in init.

Privacy

Together with your order, the ids link a person to their visits. Keep them as long as the order, and delete them with it. See URLs, requests and cookies.