How do I keep one customer from seeing another's orders?
Require verified identity for the app and take the email or customer id from the identity token's claims rather than from what the visitor types. End user token tools bind only for signed-in users.