Skip to content

AgeChecker.Net

AgeChecker.Net provides age verification for stores selling age-restricted products: a seamless server-side identity check from the customer's name, date of birth, and address, with a photo-ID popup fallback when the seamless check can't verify. Verification can gate the entire storefront or run at checkout, per the Trigger Point setting.

At a glance
Extension id agechecker
Category compliance
Version 0.1.0
Provides Age verification strategy, storefront GraphQL query + mutations, test-connection mutation
External account AgeChecker.Net account — Account Secret + API Key from the AgeChecker.Net dashboard

What It Provides

  • Age verification strategy — an AgeVerificationStrategy registered under the name agechecker. verify_age posts customer data to AgeChecker.Net's POST /v1/create; validate_token checks a popup-issued verification UUID via GET /v1/status/{uuid}; get_popup_config returns the settings the storefront popup needs. For verify_age and the popup config, credentials are resolved per call from the channel config (env fallback), following the same proxy pattern as the payment extensions; validate_token resolves credentials from the environment variables only.
  • GraphQL query ageCheckerConfig — popup configuration for the storefront, including the popup script URL (https://cdn.agechecker.net/static/popup/v1/popup.js), mode, trigger, minimum age, and checkout placement flags. Returns null when the extension is disabled for the channel or Trigger Point is disabled.
  • GraphQL mutations — verifyAge (seamless server-side verification from customer data), validateAgeToken (validates a popup verification token), and testAgeCheckerConnection (admin credential check).

Setup

  1. Once installed (or dev-linked in development), the extension is discovered at startup; enable it for your channel under Settings > Extensions.
  2. Enter your Account Secret (AgeChecker.Net dashboard, account settings) and API Key (dashboard, Install tab).
  3. Test the connection — testAgeCheckerConnection calls GET /v1/latest with both credentials and reports specifically whether the API key or the account secret is invalid. An account with no verifications yet still tests as successful.
  4. Pick a Verification Mode (seamless, popup, or both), a Trigger Point (store_wide, checkout, or disabled), and the Minimum Age; tune the checkout-placement options as needed.
  5. Credentials can alternatively come from environment variables — channel config wins, then AGECHECKER_ACCOUNT_SECRET, AGECHECKER_API_KEY, and AGECHECKER_SANDBOX.

Configuration Reference

Key Type Required Secret Description
account_secret string Yes Yes Found in your AgeChecker.Net dashboard under account settings
api_key string Yes Yes Found in your AgeChecker.Net dashboard under the Install tab
sandbox boolean No No Sandbox Mode (default true)
mode enum (seamless, popup, both) No No seamless = server-side only, popup = client-side popup only, both = seamless first with popup fallback (default both)
trigger enum (store_wide, checkout, disabled) No No store_wide = gate entire storefront, checkout = verify at checkout after payment, disabled = extension loaded but not enforcing (default checkout)
minimum_age integer No No Minimum Age (default 21)
require_dob_on_checkout boolean No No Show a date-of-birth field on the checkout form (default false)
checkout_position enum (inline, above_place_order) No No inline = show as a card in the checkout form, above_place_order = show just above the Place Order button in the sidebar (default above_place_order)
hide_place_order boolean No No Hide the Place Order button until age verification is completed (default true)
skip_verified_customers boolean No No Customers who have previously passed age verification will not be asked again (default true)

Secret fields are stored Fernet-encrypted and masked in the admin.

Permissions

  • verification.agechecker.manage

Permissions are upserted at boot from the manifest; assigning them to roles is currently a manual step.

Operational Notes

  • Verification outcomes — an API status of accepted verifies the customer; photo_id, signature, phone_validation, and pending come back unverified with a needs-photo-ID flag so the storefront can launch the popup flow; anything else (e.g. denied) is unverified.
  • Secret stays server-side — the accountSecret field returned by ageCheckerConfig actually carries the domain API key (which is meant for client-side use); the real account secret is only ever sent in server-to-server requests.
  • Minimum age — the min_age option is only sent to the API when Minimum Age differs from 21; the customer's IP is forwarded as customer_ip when available.
  • Fail-closed, non-raising — network or API failures return an unverified result (with an error detail) rather than raising, so callers decide how to proceed.
  • Timeouts — 30 s for POST /v1/create, 15 s for GET /v1/status/{uuid} and the test-connection call.
  • Live credential reads — because credentials resolve on every call, saving new credentials takes effect immediately, without re-activation (for token validation, which reads only the env vars, that means changing the environment).

For the extension developer view, see Building Extensions.