PitcherCo

ShipToVerified

<p>ShipToVerified connects your WooCommerce store with the ShipToVerified service to automate identity verification and adult signature compliance for regulated product shipments.</p>
<p>The plugin handles the full verification lifecycle:</p>
<ul>
<li>Evaluates whether an order requires adult signature or identity verification based on the customer’s shipping destination and cart contents.</li>
<li>Notifies the ShipToVerified service when a qualifying order is placed.</li>
<li>Renders a secure identity verification widget on the order confirmation and account pages so the customer can complete verification without leaving your store.</li>
<li>Receives signed webhook events from ShipToVerified when a customer completes or fails verification, and updates the WooCommerce order record accordingly.</li>
<li>Gives store administrators a manual verification option and a verification status panel directly inside the WooCommerce order screen.</li>
</ul>
<h4>Who needs this plugin?</h4>
<p>Retailers that ship age-restricted, regulated, or compliance-sensitive products (such as firearms accessories, tobacco, cannabis, or adult goods) to jurisdictions that require adult signature delivery or government-issued identity verification at the point of purchase.</p>
<h4>How it works</h4>
<ol>
<li>The merchant connects the store to ShipToVerified via an OAuth flow in WooCommerce > ShipToVerified.</li>
<li>When a customer reaches the checkout page, the plugin sends the cart’s shipping state, order total, and product details to the ShipToVerified API to determine whether the cart requires an adult signature fee or identity verification notice.</li>
<li>When the customer places an order and it moves to processing or completed status, the plugin notifies ShipToVerified with the order ID so that a verification requirement can be assigned.</li>
<li>On the order confirmation page (and optionally the account order-detail page), the plugin loads an identity verification widget served by ShipToVerified that guides the customer through document capture and liveness checks.</li>
<li>Once the customer completes the verification flow, ShipToVerified sends a signed webhook back to the store. The plugin validates the signature, marks the order as verified, and stores the verified name and address in the order meta.</li>
</ol>
<h4>External services</h4>
<p>This plugin connects to the ShipToVerified API (<code>https://api.shiptoverified.com</code>). A ShipToVerified merchant account is required. Connection is established by the store administrator during initial setup via OAuth.</p>
<p><strong>Checkout eligibility check</strong><br />
Triggered automatically on the checkout page for every customer session (including guests) while the plugin is active and connected. This call determines whether the current cart requires an adult signature fee or identity verification notice.</p>
<ul>
<li>When it runs: on every checkout page load and on each cart update (shipping address change, quantity change, etc.).</li>
<li>Data sent: customer’s shipping state (two-letter US state code), cart grand total, and line items (product ID, product name, quantity, and product category names).</li>
<li>Why it is sent: ShipToVerified maintains up-to-date jurisdiction rules for regulated products. Sending the cart snapshot allows the service to evaluate applicable state laws without storing a static ruleset inside the plugin.</li>
<li>Data received: a boolean indicating whether an adult signature fee and/or a verification notice should be displayed.</li>
</ul>
<p><strong>Order created notification</strong><br />
Triggered once per order, when the order status first moves to processing or completed.</p>
<ul>
<li>Data sent: WooCommerce order ID and store URL.</li>
<li>Why it is sent: this tells ShipToVerified to create a verification record linked to the order so it can manage the customer-facing verification flow and track completion.</li>
<li>Data received: a flag indicating whether the order requires identity verification.</li>
</ul>
<p><strong>Widget initialization</strong><br />
Triggered on the order confirmation page (and optionally the account order-detail page) when an order requires identity verification.</p>
<ul>
<li>Data sent: WooCommerce order ID and store URL.</li>
<li>Why it is sent: ShipToVerified generates a short-lived, single-use widget token scoped to that order so that the verification session cannot be replayed or hijacked.</li>
<li>Data received: a widget token and a flag confirming verification is required.</li>
<li>A JavaScript file (<code>/widget.js</code>) is then loaded directly from <code>https://api.shiptoverified.com</code> to render the verification interface. This file is served by the ShipToVerified service and is part of the core service functionality (similar to how payment processors serve their checkout scripts).</li>
</ul>
<p><strong>Webhook (inbound)</strong><br />
ShipToVerified sends a signed POST request to <code>/wp-json/shiptoverified/v1/webhook</code> when a verification event occurs (e.g., customer completes or fails verification).</p>
<ul>
<li>Data received: event type, order ID, verification ID, verified customer name, and verified shipping address.</li>
<li>All webhook payloads are validated with an HMAC-SHA256 signature before processing.</li>
</ul>
<p><strong>Order data endpoint (inbound)</strong><br />
ShipToVerified may request full order details via <code>GET /wp-json/shiptoverified/v1/order/{id}</code> to display order context inside the ShipToVerified merchant dashboard.</p>
<ul>
<li>Data returned: order line items, customer name, and shipping address.</li>
<li>Authentication: requires the store’s API key in the <code>X-API-Key</code> header.</li>
</ul>
<p><strong>Connection management (OAuth)</strong><br />
Used once during initial setup and optionally to test or re-establish the connection.</p>
<ul>
<li>Data sent: store URL, OAuth authorization code or callback parameters.</li>
<li>Data received: API key, webhook secret.</li>
</ul>
<p>By installing, activating, and connecting this plugin, the store administrator consents to the transmission of the above data to ShipToVerified on behalf of the store and its customers, in accordance with the service terms.</p>
<ul>
<li>Terms of Service: https://shiptoverified.com/terms</li>
<li>Privacy Policy: https://shiptoverified.com/privacy</li>
</ul>
<p>Merchants are responsible for disclosing the use of this service to their customers in their store’s privacy policy.</p>
<h3>Order Meta Keys</h3>
<p>The plugin stores all verification data in WooCommerce order meta. Keys are defined as constants in <code>src/App/Domains/Orders/Order.php</code>.</p>
<h4>Verification state</h4>
<ul>
<li><code>_requires_id_verification</code> — Set to <code>'yes'</code> when the STV backend determines the order requires identity verification.</li>
<li><code>_order_id_verified</code> — Set to <code>'yes'</code> when the customer successfully completes the verification flow (via widget or manual override).</li>
<li><code>_is_ffl</code> — Set to <code>'yes'</code> when the order is flagged as an FFL (Federal Firearms License) order. FFL orders are excluded from identity verification and adult signature workflows.</li>
</ul>
<h4>Verified identity data (written via webhook)</h4>
<ul>
<li><code>_order_id_verified_name</code> — Full name as verified by STV (string).</li>
<li><code>_order_id_verified_address</code> — Verified shipping address (serialized array).</li>
<li><code>_order_id_verification_timestamp</code> — MySQL datetime string recording when verification completed.</li>
<li><code>_stv_verification_id</code> — The STV-side verification UUID. Use this to look up the verification record in the ShipToVerified dashboard.</li>
</ul>
<h4>Widget and notification state</h4>
<ul>
<li><code>_stv_widget_token</code> — Short-lived, single-use token used to initialise the frontend verification widget. Generated by STV and stored temporarily; do not rely on its value after the order is verified.</li>
<li><code>_stv_order_created_notified</code> — Set to <code>'yes'</code> after the plugin has successfully notified the STV backend of a new order. Prevents duplicate notifications on status re-changes.</li>
<li><code>_stv_webhook_processed_{event_id}</code> — Idempotency guard. Written once per processed webhook event to prevent duplicate processing if STV delivers the same event more than once. <code>{event_id}</code> is the event UUID from the STV webhook payload.</li>
</ul>
<h4>Reminder emails (manual verification flow)</h4>
<ul>
<li><code>_id_verification_first_reminder_sent_at</code> — Timestamp of the first reminder email sent to the customer.</li>
<li><code>_id_verification_second_reminder_sent_at</code> — Timestamp of the second reminder email sent to the customer.</li>
</ul>
<h3>Hooks Reference</h3>
<p>= Filters the plugin listens to =</p>
<ul>
<li><code>woocommerce_order_actions</code> (priority 10, 2 args) — Adds the <strong>Mark as Manually Verified</strong> entry to the order action dropdown in the admin order screen (<code>ManualVerifyOrderFilter::addManualVerificationOrderAction</code>).</li>
</ul>
<h4>Custom actions the plugin fires</h4>
<p>Third-party code can hook into these to react to verification events.</p>
<pre><code>do_action( 'shiptoverified_order_id_verification_complete', int $order_id )
</code></pre>
<p>Fired when an order is marked as successfully verified — either by the STV webhook completing the customer flow, or by the admin using the manual verify order action.<br />
* <code>$order_id</code> (int) — The WooCommerce order ID that was just verified.</p>
<pre><code>do_action( 'shiptoverified_add_ca_signature_fee', bool $requires )
</code></pre>
<p>Fired during checkout eligibility evaluation after the cart rules are checked against the STV backend.<br />
* <code>$requires</code> (bool) — <code>true</code> if the current cart requires an adult signature fee; <code>false</code> otherwise. Hook into this to add or remove a fee line item on the cart.</p>
<h3>REST API Endpoints</h3>
<p>Both endpoints are registered under the namespace <code>shiptoverified/v1</code>.</p>
<h4>GET /wp-json/shiptoverified/v1/order/{id}</h4>
<p>Returns order details to the ShipToVerified merchant dashboard.</p>
<ul>
<li><strong>Authentication:</strong> <code>X-Api-Key</code> request header must match the <code>stv_api_key</code> WordPress option.</li>
<li><strong>Response:</strong> order line items, customer name, and shipping address.</li>
<li><strong>Use:</strong> called by the STV backend when a merchant views an order inside the ShipToVerified dashboard.</li>
</ul>
<h4>POST /wp-json/shiptoverified/v1/webhook</h4>
<p>Receives verification event callbacks from ShipToVerified.</p>
<ul>
<li><strong>Authentication:</strong> open endpoint, but every request is validated against an HMAC-SHA256 signature in the <code>X-Stv-Signature</code> header using the <code>stv_webhook_secret</code> option. Requests with an invalid signature or a timestamp outside the 5-minute window are rejected with <code>403</code>.</li>
<li><strong>Payload fields:</strong> <code>event_type</code>, <code>event_id</code>, <code>order_id</code>, <code>verification_id</code>, <code>verified_name</code>, <code>verified_address</code>.</li>
<li><strong>On success:</strong> updates order meta, fires <code>shiptoverified_order_id_verification_complete</code>, returns <code>200</code>.</li>
</ul>
<h3>Testing & Review Guide</h3>
<p>This section is intended for WordPress.org and WooCommerce plugin reviewers. It explains how to test each feature end-to-end.</p>
<p>A sandbox/test account can be requested from the ShipToVerified team at support@shiptoverified.com. Please mention that you are reviewing the plugin for WordPress.org.</p>
<h4>Setup</h4>
<ol>
<li>Install and activate WooCommerce. Create at least one simple product.</li>
<li>Install and activate ShipToVerified.</li>
<li>Go to WooCommerce > ShipToVerified and click “Connect with ShipToVerified”.</li>
<li>Complete the OAuth flow. On success, the settings page shows a green “Connected” badge, the API key (read-only), and widget placement checkboxes.</li>
</ol>
<p>Things to verify:</p>
<ul>
<li>The “Connect” button generates a nonce-protected URL (action <code>stv_oauth_start</code>).</li>
<li>After authorization, <code>stv_api_key</code> and <code>stv_webhook_secret</code> are stored in <code>wp_options</code>.</li>
<li>The “Test Connection” button calls the STV API and reports success or failure.</li>
<li>Widget placement checkboxes (Thank You page, View Order, Order Tracking) save correctly.</li>
</ul>
<h4>Order Verification Flow</h4>
<p>When an order moves to <code>processing</code> or <code>completed</code>, the plugin notifies ShipToVerified.</p>
<ol>
<li>Place a test order and complete payment so the order reaches <code>processing</code>.</li>
<li>Open the order in WooCommerce > Orders.</li>
</ol>
<p>Things to verify:</p>
<ul>
<li>The order has meta <code>_stv_order_created_notified = yes</code> (notification was sent).</li>
<li>If the STV account is configured for verification, the order may be moved to “Awaiting Verification” status (<code>wc-await-verify</code>).</li>
<li>The admin order detail panel shows a “California ID Verification” section with either a green “Verified” badge or a yellow “Pending” badge.</li>
<li>FFL orders (meta <code>_is_ffl = yes</code>) are skipped entirely.</li>
<li>The notification is sent only once per order (idempotency via <code>_stv_order_created_notified</code>).</li>
</ul>
<h4>Verification Widget</h4>
<p>The plugin injects a JavaScript widget on customer-facing order pages so the customer can complete identity verification.</p>
<ol>
<li>Place an order that requires verification.</li>
<li>On the Thank You page, the widget should render with a verification prompt.</li>
<li>Alternatively, go to My Account > Orders > View Order for the same order.</li>
</ol>
<p>The widget appears on these pages (controlled by settings checkboxes):</p>
<ul>
<li>Thank You page (<code>woocommerce_thankyou</code>) — enabled by default.</li>
<li>My Account > View Order (<code>woocommerce_view_order</code>) — enabled by default.</li>
<li>Order Tracking (<code>woocommerce_order_tracking</code>) — disabled by default.</li>
</ul>
<p>Things to verify:</p>
<ul>
<li>The widget only renders for orders with <code>_requires_id_verification = yes</code>.</li>
<li>The widget does not render for already-verified orders (<code>_order_id_verified = yes</code>).</li>
<li>The widget does not render for FFL orders or FFL customers.</li>
<li>The widget does not render for admin users viewing the page.</li>
<li>The script is enqueued via <code>wp_register_script</code> / <code>wp_enqueue_script</code> (not echoed directly).</li>
</ul>
<h4>CA Adult Signature Notice</h4>
<p>For orders shipping to California, the plugin can display a notice at checkout.</p>
<ol>
<li>Add products to the cart and go to checkout.</li>
<li>Enter a California shipping address.</li>
<li>If the STV account has adult signature rules configured, a notice appears above the payment section.</li>
<li>Change the shipping state to a non-CA state — the notice should disappear.</li>
</ol>
<p>Things to verify:</p>
<ul>
<li>The notice renders inside <code>#ca-adult-signature-notice</code>.</li>
<li>The notice updates when the checkout form is refreshed (AJAX fragments).</li>
<li>FFL customers are excluded.</li>
<li>Results are cached per session to avoid redundant API calls (cache key: cart hash + state + total).</li>
</ul>
<h4>Manual Verification</h4>
<p>Admins can manually mark an order as verified.</p>
<ol>
<li>Open an order that requires verification in WooCommerce > Orders > Edit Order.</li>
<li>In the “Order actions” dropdown, select “Mark ID Verified”.</li>
<li>Click the action button.</li>
</ol>
<p>Things to verify:</p>
<ul>
<li>The plugin calls the STV manual-verify endpoint.</li>
<li>Order meta is updated: <code>_order_id_verified = yes</code>, <code>_order_id_verification_timestamp</code>, <code>_order_id_verified_name</code>, <code>_order_id_verified_address</code>.</li>
<li>An order note is added with the verification ID.</li>
<li>The action <code>shiptoverified_order_id_verification_complete</code> is fired.</li>
<li>If the order has parent/child relationships, verification propagates to related orders.</li>
<li>FFL orders are excluded.</li>
</ul>
<h4>REST API Endpoints</h4>
<p>Test the endpoints with any HTTP client. Both endpoints require the <code>X-Api-Key</code> header set to the API key shown on the plugin settings page.</p>
<p><strong>Order details:</strong><br />
Send a GET request to <code>https://your-store.com/wp-json/shiptoverified/v1/order/123</code> with the <code>X-Api-Key</code> header.</p>
<p>Expected response includes: <code>order_id</code>, <code>status</code>, <code>total</code>, <code>currency</code>, <code>billing_email</code>, <code>customer</code>, <code>shipping_address</code>, <code>items</code>.</p>
<p><strong>Order statuses:</strong><br />
Send a GET request to <code>https://your-store.com/wp-json/shiptoverified/v1/order-statuses</code> with the <code>X-Api-Key</code> header.</p>
<p>Things to verify:</p>
<ul>
<li>Requests without a valid <code>X-Api-Key</code> return <code>401</code>.</li>
<li>Invalid order IDs return an appropriate error response.</li>
</ul>
<h4>Webhook Handling</h4>
<p>The STV backend sends webhook events to <code>POST /wp-json/shiptoverified/v1/webhook</code> when a customer completes verification.</p>
<p>Signature format: <code>X-Stv-Signature: t={unix_timestamp},v1={hmac_sha256_hex}</code> computed over <code>{timestamp}.{raw_body}</code> using the <code>stv_webhook_secret</code>.</p>
<p>Things to verify:</p>
<ul>
<li>Invalid signatures return <code>401</code>.</li>
<li>Expired timestamps (older than 5 minutes) return <code>401</code>.</li>
<li>Duplicate <code>event_id</code> values are ignored (returns <code>200</code> but no duplicate processing).</li>
<li>After a valid webhook: order meta and order notes are updated correctly.</li>
</ul>
<h4>Uninstall Cleanup</h4>
<ol>
<li>Deactivate and delete the plugin from Plugins > Installed Plugins.</li>
</ol>
<p>Things to verify:</p>
<ul>
<li>All plugin options are removed from <code>wp_options</code>: <code>stv_api_url</code>, <code>stv_api_key</code>, <code>stv_webhook_secret</code>, <code>stv_settings</code>, <code>stv_site_url</code>, <code>id_to_verify_settings</code>.</li>
<li>Order meta is preserved (verification records must survive for compliance and audit purposes).</li>
</ul>


ShipToVerified integrates WooCommerce with ShipToVerified to support identity verification and shipping compliance workflows.

konfirmillc

<p><strong>Verify your customers automatically!</strong></p>
<p>KONFIRMI provides an easy and affordable way to automatically verify your customer’s identity and other information — in any e-commerce store, registration form, contact form or survey, webform, or online application.</p>
<p><strong>Set up takes less than 5 minutes!</strong></p>
<p>For example, this video shows KONFIRMI being set up in about 4 minutes:</p>
<p><a href="https://konfirmi.com/#howitworks" rel="nofollow ugc">Click Here for Set Up Example Video</a></p>
<p>KONFIRMI goes beyond just providing a popup asking a user or customer to provide their information or state their age.  KONFIRMI also goes beyond fraud prevention and CAPTCHA-like functionalty.  In addition, KONFIRMI avoids many problems often present in other customer verification systems.</p>
<p>Our easy-to-use app allows you to select from a variety of ways to automatically verify your customer’s information, such as:</p>
<ul>
<li>Age</li>
<li>Photo ID</li>
<li>Mailing Address</li>
<li>Phone number</li>
<li>Email Address</li>
</ul>
<p>before any services are provided, before any access is granted, and before any products are sold or delivered.</p>
<p>+++++++++++++++++</p>
<p><strong>USE KONFIRMI TO AVOID VIOLATING THE LAW</strong></p>
<p>Our app provides an easy and affordable way to comply with various laws affecting e-commerce and other online businesses:</p>
<p><strong>True Age Verification:</strong>  KONFIRMI lets you automatically verify your customer’s age!  Online sellers of age restricted products — like certain kinds of video games, liquor and alcoholic beverages, tobacco and vaping products, marijuana sales, pornography, and gambling services — must check the buyer’s government-issued photo ID, or in some cases at least verify the buyer’s information against consumer databases, to ensure that the buyer is old enough. In most cases, you also need a clear audit trail to prove the verifications were being done properly.  KONFIRMI handles all of this automatically!</p>
<p><strong>No Facial Recognition.</strong>  Studies have shown that facial recognition is unreliable with non-Caucasians — just search the internet, and you will find several reputable studies and articles on this issue.  In addition, facial recognition is disfavored and highly problematic in many places, including in the European Economic Area (EEA) and in several states in the United States.  In some cases, you even need a written release from your customer to use facial recognition or other biometrics, and written disclosure of the specific purpose and duration of time for which the facial recognition or biometric information is being collected, stored, and used.  KONFIRMI lets you avoid all of this!</p>
<p><strong>“Behind the Scenes” Verification.</strong>  KONFIRMI gets the consents you need to verify your customers!  In many countries, including in the United States, it is often illegal to identify individuals without their knowledge and consent, especially using biometrics of any kind.  This is easy with KONFIRMI!</p>
<p><strong>GDPR Compliance:</strong>  KONFIRMI allows you to easily comply with the GDPR!  Under the European Union’s General Data Protection Regulation (GDPR), EU residents have the right to request information you have about them, and have you delete or correct this information.  However, you first have to verify that the request is actually from your customer.  KONFIRMI handles this for you!</p>
<p><strong>CCPA Compliance:</strong>  KONFIRMI also lets you easily comply with the CCPA!  Under the new California Consumer Privacy Act (CCPA), businesses have to provide California customers with a copy of their personal information held by the business, and delete or correct their information upon request.  However, you first have to verify that the request is from the customer.  KONFIRMI handles this for you automatically!</p>
<p>+++++++++++++++++</p>
<p>KONFIRMI allows you to easily get Single- or Multi-Factor Authentication for your customers.</p>
<p>You can easily pick and choose from many simple or sophisticated verification methods.</p>
<p>In addition, you can easily swap out one verification method for another, stack or layer various verifications methods together, and ‘mix and match’ different verification methods for use in various parts of your website.</p>
<p>For example, our most popular combination of verification methods is “SMS/Text Code” authentication, combined with “Knowledge Based” or “Information Check” authentication.</p>
<p>This combination allows you to automatically verify your customer’s phone number or email address with third-party data sources, and then have your customer enter a code sent that same phone number or email address.</p>
<p>This combination is very hard to spoof, but also is very fast and easy for your customers!</p>
<p>KONFIRMI works with WooCommerce, as well as various popular contact form plugins.</p>
<p>For more information, please visit:</p>
<p><a href="https://konfirmi.com" rel="nofollow ugc">Konfirmi Website</a></p>
<p>+++++++++++++++++</p>
<p><strong>NEW FEATURES:</strong></p>
<p><strong>Works Internationally:</strong></p>
<p>Your customers can easily change the language they see.  In addition, our app allows you to select the language that your customers will see first.</p>
<p><strong>Easy to Customize:</strong></p>
<p>You can easily change the appearance of the parts of our app that your customers see.  You can also add your own company logo for consistent branding on your website.</p>


Konfirmi Plugin

KONFIRMI allows you to easily and automatically verify your customer's age, ID, address, and other information.

ShipToVerified vs Konfirmi Plugin