WooCommerce

The WooCommerce plugin puts a verification step into your existing checkout. Your WordPress server holds the API key and talks to the verification API; the checkout page itself never sees the key.

It is one of three integrations — see also Shopify and the JavaScript widget. Pick the one that matches your storefront; they are alternatives, not layers.

Before you start

You also need an API key from your merchant dashboard, and an account with an active subscription — see API keys and billing.

1. Install and activate

Upload the plugin folder to wp-content/plugins/ and activate it from the Plugins screen, as with any WordPress plugin. It works with both Classic and Blocks checkout, and it is compatible with High-Performance Order Storage.

Once active, its settings live at WooCommerce → Settings → eIDAS Verify.

2. Connect your API key

On that settings screen:

• API URL — the base URL of the verification API you are integrating against, for example https://api.eidas-pro.com. No trailing slash.
• API Key — the key from your merchant dashboard. It is stored in WordPress options and sent server-to-server as the x-merchant-api-key header; it is never printed into the checkout page.
• Enable Verification — the master switch. Leave it off until the rest is configured.

3. Choose what to verify

• Verification Type — the dropdown offers a single option, Age only. Country and combined checks are not implemented end-to-end yet, so there is nothing else to choose. See how a verification works.
• Verification Method — which family of identity method to request. The eID option routes to bank or government electronic identity; the EU wallet option is a preview and is not a live capability.
• Country restrictions — optional allow and block lists, carried on the session.
• Branding — the accent, text, background and border colours of the checkout verification panel, so it does not look pasted in.

Whether any method can serve a request is a property of the deployment, not of these settings. Check it before you launch:

curl https://api.eidas-pro.com/api/config

An empty supportedMethods array means no method is configured there yet and every session will fail closed, whatever the plugin is set to.

4. Choose which products are gated

Gating is per product, and it is opt-out:

• With verification enabled globally, every product requires verification at checkout.
• Each product has an eIDAS Verify Settings box on its edit screen with a skip verification for this product checkbox. Tick it for everything that does not need a check.
• Each product category has its own skip verification for products in this category checkbox, on the category's add/edit screen under Products → Categories. Ticking it exempts every product filed under that category.
• The product-level box also has an override global settings option, which lets one product use its own country allow/block lists instead of the store-wide ones. A verification-type field is shown there too, but it offers the same single Age only option as the global setting — there is nothing to actually override, and the plugin does not persist a per-product value for it.

A cart triggers verification if it contains at least one product that is neither individually skipped nor filed under a skipped category.

5. What the shopper sees

At checkout, before order review, the plugin shows a verification step. The shopper completes the identity step with their provider and is returned to your checkout.

While they are away, your WordPress server polls the verification API roughly every two seconds and updates the checkout page when the session reaches a verdict. Checkout proceeds only after the server has confirmed a pass — the browser is never the thing that decides.

The plugin records each attempt in a verification log inside your own WordPress database, and surfaces it as an admin list page, an orders column, and a per-order meta box, so you can see afterwards which orders were gated and how they resolved.

6. Test before you launch

1. Confirm supportedMethods is non-empty for your deployment. If it is empty, nothing further will work, and that is the deployment's state rather than a mistake in your setup.
2. Put a non-skipped product in a cart and go to checkout. The verification step should appear.
3. Complete a verification and confirm the order goes through and appears as verified in the admin log.
4. Abandon one and confirm checkout stays blocked.

If a step fails, troubleshooting maps the error codes the plugin surfaces — invalid_merchant_key, no_subscription, layer_not_entitled — to their causes.

What the plugin never receives

The verification API returns a session status and two booleans, and no personal data at any point — no date of birth, no name, no country, no document. The plugin therefore has none to store. What it keeps in your database is its own record of the attempt: the session id, the outcome, and the customer details WooCommerce already had from the order.