BigCommerce

​

Overview

The iDenfy BigCommerce app adds identity verification to your store. Decide when shoppers verify (4 flows), which carts need it (an optional custom rule), and keep orders from unverified customers on hold until they verify, all from the BigCommerce control panel.

---

​

How It Works

The app runs inside the BigCommerce control panel and opens from the Apps menu. It has a Home page and a Settings page with three tabs: Connection, Verification settings, and Customers. The Help link in the app header opens iDenfy support. When you pick a verification flow, the app sets up these parts through the BigCommerce API. There is no theme to edit. Nothing runs on the checkout page where shoppers pay. Verification opens iDenfy’s hosted UI in a modal on your store, so the shopper never leaves your site. iDenfy then sends the result back to the app, which:

• stores the result and shows it on the Customers tab;
• writes an idv_status attribute on the BigCommerce customer;
• releases that customer’s held orders, if the result is Approved.

Shoppers are identified by their BigCommerce customer account, so only signed-in shoppers can be verified. Guests have no customer ID. The storefront proves who the shopper is with BigCommerce’s signed customer token, so a browser can’t start or check a verification for another customer. Each verification reaches iDenfy with the client ID bc:{storeHash}:{customerId}. Search for it in the iDenfy dashboard to find a shopper’s verification. Documents, photos, and biometric data stay with iDenfy; see Data and Privacy for what the app keeps.

---

​

Quick Start

---

​

Verification Flows

Choose the flow under Settings → Verification settings → Verification flow. Pick the one moment in your store where shoppers are asked to verify:

• Exactly one flow is active at a time. Selecting a flow turns off the others.
• Clicking the active card turns verification off.
• Each card shows Updating… while a change applies, then Active or Off.
• Until your iDenfy account is connected, the tab shows “Connect iDenfy first” instead.

In every flow:

• A customer whose status is Approved is never asked again. Verification happens once per customer, not once per order.
• Every other status counts as unverified: Pending, Reviewing, Suspected, Denied, Expired, Revoked, and customers who never started.
• Orders from unverified customers are held. The prompts on your storefront are how shoppers are asked; the order hold is what enforces it.

​

The Verification Banner

A signed-in shopper with an order on hold sees a banner under your store’s header until they verify. It appears on home, category, product, cart, search, and content pages.

• Identity verification required. “You have an order on hold. It will be processed once you complete a quick identity verification.” With more than one held order, it gives the count: “You have 2 orders on hold. They will be processed…”
• Verify your identity opens iDenfy directly.
• The × (Not now) hides the banner until the shopper’s next visit.
• After approval, the banner turns green: “Thank you — your identity has been verified and your order will be processed shortly.”

In After account registration, the banner shows for every signed-in customer who isn’t verified, with the text Verify your identity. “Please complete a quick identity verification, powered by iDenfy, before you check out.” It has no × in that flow. The banner doesn’t appear on My Account, Login, or checkout pages: BigCommerce doesn’t load the storefront script there. On phones, when the theme’s header is fixed to the top of the screen, the banner sits at the top of the page content instead.

​

What Shoppers See After Verifying

Every verification in a modal ends on one of these screens:

---

​

Storefront Setup

There is nothing to enable in your theme. Choosing a flow installs two scripts, listed in your store’s Script Manager: Switching flows replaces the scripts, turning verification off removes them, and BigCommerce removes them automatically when you uninstall the app. Don’t edit or delete them by hand; if they’re missing or outdated, the app offers an update.

• Checkout page. No script loads on the checkout page where shoppers pay. The checkout prompt acts on the button that leads there.
• Cookie consent. Both scripts are registered in the Essential cookie category, so they load before the shopper accepts cookies. Without this, the checkout prompt wouldn’t load for shoppers who haven’t accepted. You may want to mention it in your cookie policy.
• Look and feel. The modal, banner, and order panel can’t be customized: there are no style settings and no editable text. The modal carries iDenfy branding (the iDenfy logo, a purple button, and a “Powered & trusted by iDenfy” footer). The banner and order panel use your theme’s font. Their text is in English only.
• Verification UI. The verification steps inside the modal follow your iDenfy dashboard settings, including languages and branding.
• Accessibility. The modal is a keyboard-accessible dialog: Esc closes it, and focus stays inside it while it’s open.

Debug Mode

To see what the script is doing on a page, add ?idenfy_debug=1 to any storefront URL, or run localStorage.idenfy_debug = '1' in the browser console and reload.The console then shows [idenfy] lines: the flow loaded, whether the shopper is a guest or signed in, their verification status, the cart summary, the cart check result, and the final decision. If no [idenfy] lines appear, the script isn’t loading.

---

​

Custom Rule

The rule panel appears below the flow cards when Custom is active. Verification is required at checkout when the cart matches any of these conditions. Leave them all blank to require verification for every checkout.

• The conditions are combined with OR.
• Save rule is enabled only when something has changed. On success, the panel shows “Rule saved.”
• The same rule decides which orders are held.
• A product matches only the categories it’s directly assigned to. Choosing a parent category doesn’t cover products assigned only to its subcategories.
• The cart total is the amount after discounts and coupons, including tax where it applies, and before shipping. It’s compared as a number in the cart’s currency, so on a multi-currency store the threshold applies to whichever currency the shopper is using.

---

​

Identity Check Settings

​

Which Checks Run

The identity checks themselves, such as accepted document types, liveness, AML, and age, are configured in the iDenfy dashboard for the connected API key, not in the app. Under Result handling, the app has two switches. Each is saved as soon as you change it, and the tab shows “Saved.”

​

Match the Name on the Customer’s Account

When this is on, the app sends the customer’s first and last name from their BigCommerce account to iDenfy with each new verification. If the name doesn’t match the ID document, iDenfy returns Suspected. The app reads the name from BigCommerce when the verification starts and doesn’t store it. Off by default. When it’s off, no names are sent.

​

Accept Suspected Verifications

This decides what happens to results that iDenfy flags as Suspected:

• Off (default): a Suspected result stays Suspected. The customer counts as unverified, and held orders stay held until you decide on the Customers tab.
• On: a Suspected result is recorded as Approved and marked auto-approved (suspected) on the Customers tab. The shopper sees the success screen, and held orders are released.

​

Guest Checkout Warning

When a flow is active and your store allows guest checkout, the Verification settings tab shows a Guests bypass verification warning: “This store allows checkout without an account. Guest orders carry no customer ID, so they cannot be verified or held. Require shoppers to create an account at checkout to close this gap.” Click Open checkout settings to change the setting in BigCommerce. If the app can’t read the setting, it shows a neutral Check your guest checkout setting note instead.

​

Credits and Attempt Limits

• Each new iDenfy verification session uses a verification credit.
• A shopper’s unfinished session is reused at no extra cost for 24 hours. If they don’t start it in that time, it expires, and the next prompt creates a new one.
• A shopper can start at most 5 new sessions in 24 hours. After that, they see Too many attempts and can try again later.
• Links you create with Copy verification link don’t count toward that limit.
• Connecting doesn’t create a verification session: the app checks your API keys with a read-only request. Only if iDenfy doesn’t answer that request does the app create a test session instead, with a client ID starting bc-validate-.

---

​

Order Hold

The order hold is on in every flow. It’s the step that stops orders from unverified customers, whatever happened on the storefront:

• After checkout: the hold is the flow itself.
• Before checkout and After account registration: it catches orders that got past the storefront prompt.
• Custom: it holds only orders that match your rule.

An order is held when all of these are true:

• the customer was signed in (guest orders are never held);
• the order was placed on the default storefront (channel 1);
• the order status isn’t Incomplete, Refunded, Cancelled, or Declined;
• the customer’s verification status isn’t Approved;
• in Custom, the order matches your rule.

For card payments, BigCommerce creates the order as Incomplete until the payment goes through. The app holds the order as soon as it leaves Incomplete.

​

Releasing Held Orders Without Verification

If you turn verification off or disconnect iDenfy, new orders are no longer held, but orders already held stay in Manual Verification Required. Each is still released if its customer is approved. While such orders remain, the Home and Settings pages show a N orders are still on hold notice with a Release all button. It returns each order to its previous status, whether or not its customer verified, then reports how many were released. Orders you’ve already moved out of Manual Verification Required are left as they are. To release one customer’s orders, set their status to Approved on the Customers tab.

Edge Cases

• The hold needs BigCommerce’s built-in Manual Verification Required order status. If the app can’t find it, choosing a flow fails with Could not resolve the “Manual Verification Required” order status.
• Changing a customer from Approved to another status doesn’t hold orders that were already released. Their future orders are held.
• Revoke and Revoke & erase iDenfy data leave that customer’s held orders on hold.
• Switching between flows keeps the hold on. Turning verification off stops new holds.
• If you change a held order’s status yourself, the app leaves it as you set it.

---

​

Managing Verifications

The Settings → Customers tab lists every customer who has been asked to verify, with their current iDenfy verification status. A customer appears once they start a verification, an order of theirs is held, or a result arrives. A shopper who only saw a prompt isn’t listed. Search by email (partial and case-insensitive), and show 10, 20, 50, or 100 rows per page, most recently updated first.

​

Changing a Status

Use the Status dropdown to set Approved, Denied, Suspected, or Reviewing.

• Setting Approved releases the customer’s held orders.
• Moving a customer away from Approved asks for confirmation: Change status from Approved? They’re asked to verify again on future orders, and orders that were already released stay released.

​

Send a Verification Link

To reach a shopper yourself, open the ⋯ menu on their row and choose Copy verification link. It isn’t offered for Approved customers. The Verification link dialog shows a link to send by email or however you usually reach the customer. They verify on iDenfy’s page, the result appears on the Customers tab automatically, and any order of theirs on hold is released once they’re approved. Under the link, the dialog shows the date and time it stops working: “Works until … , or until it is used.”

• The app reuses the customer’s unfinished session if it has at least 12 hours left. Otherwise it creates a new one, which uses a credit and sets the status to Pending.
• These links don’t count toward the shopper’s attempt limit.
• Verifications started this way show Flow = Manual.

​

Revoke

The ⋯ menu also has two ways to revoke a customer. Both ask you to confirm first, set the status to Revoked, and ask the customer to verify again next time. Held orders stay held.

• Revoke marks the customer as unverified. Their verification data stays in iDenfy.
• Revoke & erase iDenfy data also permanently deletes their photos and document data from iDenfy. It can’t be undone.

​

Customer Details

Click the eye icon on a row to see:

• Contact: name, email, and customer ID.
• Verification: status; how it was set (From iDenfy / verification flow, Auto-approved (suspected), or Manually set, with the ID of the user who set it); flow; the raw iDenfy status; scan reference; first seen; last updated; and session created.
• Risk signals: suspicion reasons, fraud tags, and mismatch tags from iDenfy.
• Recent orders: the last 5, each linking to the order in your control panel.

​

What the App Writes to BigCommerce

• Customer: an idv_status customer attribute (text), created the first time it’s needed. It’s set when a final result arrives, when you change the status, or when you revoke: APPROVED, DENIED, SUSPECTED, EXPIRED, REVIEWING, or REVOKED. It isn’t set while a session is only pending. Other apps and integrations can read it through the BigCommerce Customers API.
• Order: only the status change to and from Manual Verification Required.

Nothing else is written: no order notes, tags, or other fields, and the customer’s name, email, and phone aren’t changed.

---

​

Connection, Disconnect and Uninstall

The Settings → Connection tab shows a Connected or Not connected badge and your masked API key. The API secret is encrypted and can’t be displayed after saving; reconnect to replace your credentials. Under Results webhook, the tab shows either “Set up automatically in your iDenfy account when you signed in”, or, for a manual connect, the Receiver URL to add in iDenfy, with a copy button.

• Reconnect opens the same dialog as the first connection. With Sign in with iDenfy, it creates a new API key and webhook, then deletes the previous ones the app created in your iDenfy account. If reconnecting fails, your existing setup keeps working.
• Disconnect asks you to confirm, then removes the storefront scripts and order webhooks and clears your saved credentials. Shoppers stop being asked right away, and new orders are no longer held. Verification records are kept, and orders already on hold stay held (release them from the notice). The API key and webhook stay in your iDenfy account; delete them there if you no longer need them. Afterwards no flow is active, so pick one again after reconnecting.
• Uninstalling the app makes BigCommerce remove the storefront scripts. The app deletes everything it holds for your store: credentials, settings, verification records, and held-order records.

​

Maintenance Banners

The Settings page shows a banner when the app’s setup in your store needs attention:

• Update your storefront setup: your scripts or order webhooks were set up by an earlier version of the app. Click Update now so verification works on every page and every order is held.
• App URL has changed: the scripts and webhooks point to an old address of the app. Click Repair now. If you connected with Sign in with iDenfy, reconnect afterwards to re-register the iDenfy webhook.

---

​

Data and Privacy

The app keeps only what it needs to remember each customer’s verification status and the orders it holds.

• Not stored: names, documents, photos, biometric data, or document numbers. Documents, photos, and biometric data stay in your iDenfy account. Names are read from BigCommerce when you open the Customers tab and, with name matching on, sent to iDenfy when a verification starts.
• Shopper contact: the app sends no emails or messages to shoppers.
• Erasing: Revoke & erase iDenfy data deletes a customer’s verification data in iDenfy. Uninstalling deletes everything the app stores for your store.

---

​

Reference

​

Verification Statuses

​

Troubleshooting

​

FAQ

---

​

What’s Next?