Integrations

Ad-Hoc Verify is designed to plug into the platforms and workflows you already use. Choose from a native platform plugin or build your own using an integration key or the REST API.

BigCommerce Plugin

A ready-made plugin for BigCommerce Stencil storefronts. Add it via Script Manager to put a verification step on your cart and/or checkout page — no server required.

Setup

  1. Generate an integration key from Profile → Integration Key and add your store domain to the allowlist (e.g. yourstore.mybigcommerce.com).
  2. In the BigCommerce control panel, go to Settings → Store-level API accounts and create a new API account with Carts and Customers read/write scopes. Copy the generated access token and note your store hash from the store URL.
  3. In Script Manager, add a new script to All pages, placement Footer:
<script> window.AdHocVerifyConfig = { apiKey: 'ahv_pub_...', // Your integration key storeHash: 'abc123', // Your BC store hash storeAccessToken: 'TOKEN', // BC store-level API access token pages: ['cart', 'checkout'], ruleset: { requireVerification: true, requireOver18: false, } }; </script> <script src="https://adhocverify.com/plugin/bigcommerce.js"></script>

On page load the plugin checks whether the current cart or logged-in customer already has a valid verification stored in BigCommerce metafields. If so, it shows a "Verified ✓" badge. If not, it shows a "Verify ID" button and (optionally) disables the checkout button until verification is complete.

i
BigCommerce's cart and customer metafield APIs are server-to-server only — they don't support browser CORS. The plugin routes all metafield reads and writes through the Ad-Hoc Verify API as a proxy so your storeAccessToken never goes directly to api.bigcommerce.com from the browser.

Ruleset Options

The ruleset object controls what counts as a passing verification:

requireVerificationDisable the checkout button until a verification is complete (default: true)
minFaceMatchScore'definite_match' | 'likely_match' | 'possible_match' | null — minimum face match tier required
requireOver18Reject verifications where over_18 is false
requireOver21Reject verifications where over_21 is false

Integration Keys

An integration key is a publishable API key generated from the Profile page of your dashboard. It allows an external application — a storefront plugin, a custom integration, or any code running in a browser or server — to call the Create Verification endpoint on your behalf.

Unlike your account credentials (email + password) or a session JWT, an integration key is designed to be embedded in third-party code. It is scoped to a specific list of allowed domains and cannot access anything beyond creating verifications — it cannot read results, modify templates, or manage your account.

Example integration key
ahv_pub_a1b2c3d4e5f6...

Key Restrictions

Domain Allowlist

Every integration key is locked to one or more allowed domains. When a request arrives using your key, the Origin header must match a domain on your allowlist — requests from unlisted origins are rejected with a 403.

Wildcards are supported: adding *.yourcompany.com permits requests from any subdomain of yourcompany.com, including the root domain itself.

!
An integration key with no domains configured will reject all requests. Add at least one domain before deploying your integration.

Rate Limit

Each integration key is limited to 30 requests per hour by default. This prevents runaway integrations from creating an unbounded number of verifications.

Scope

An integration key can only call POST /create-verification. It cannot retrieve results, list verifications, access templates by UUID, or perform any administrative action. Results are delivered to your system via webhooks or retrieved server-side using your account credentials.

Using the Key

Pass the integration key in the X-API-Key header when calling the POST /create-verification endpoint (it accepts the same body as Create Verification). The Authorization header is not required when using a key.

curl -X POST https://verify-api.ad-hoc.app/create-verification \ -H "X-API-Key: ahv_pub_a1b2c3d4e5f6..." \ -H "Content-Type: application/json" \ -H "Origin: https://yourstore.com" \ -d '{ "template_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "external_id": "order-9981" }'

The response is identical to the standard API response — a verification id and url ready to send to the end user.

i
Pair external_id with your integration key requests to correlate each verification with a record in your platform — an order number, a customer ID, or any non-PII reference value. It will be echoed back in the webhook payload when the verification completes.

Generating a Key

Integration keys are managed from the Profile page in your dashboard:

  1. Navigate to Profile.
  2. Scroll to the Integration Key section.
  3. Click Generate API Key.
  4. Copy the key immediately — it is only shown once.
  5. Add the domains that will be making requests using this key.

Only one integration key exists per account at a time. Generating a new key immediately revokes the previous one — update any deployed integrations before regenerating.

Need more control? Use the full REST API with your account credentials.

API Reference →