Aldersverificering – MitID Age Verification for WooCommerce

Description

Verify your customers’ age with MitID in WooCommerce. Aldersverificering connects your store to a MitID verification flow, so customers can confirm their age before buying age-restricted products.

Built for webshops serving customers who use MitID in Denmark. Set the required age for your store, categories, products or individual variations — including 16+ and 18+ checks.

How MitID age verification works

1. Your checkout requests an age check. The plugin uses your product rules and configured delivery policy to decide whether verification is required.
2. The customer confirms with MitID. The familiar MitID flow opens in a popup or redirects the customer to verification.
3. WooCommerce checks the result. When verification is required, checkout continues only with a valid result that meets the required age. Cancelled, missing or insufficient results do not grant access to checkout.

This is a MitID-based age check, rather than a checkbox where customers declare their own age. Customers must be able to use MitID; the plugin does not provide passport or foreign ID-card verification.

Free plugin and test environment

The plugin is free software. An Aldersverificering.dk account and API key are required. Test the MitID flow for free with test keys and MitID test identities. Real production verifications require a paid service plan. See service pricing. Payment is for the external verification service, not for unlocking plugin code.

MitID features for WooCommerce

• MitID age verification with server-side validation of the signed result
• Works with both classic WooCommerce checkout and the modern Checkout Block
• Compatible with WooCommerce HPOS (High-Performance Order Storage)
• Two targeting modes:
  • All products — every checkout requires verification
  • Selected products & categories — gate only specific items
• Per-product, per-category, and per-variation age overrides
• Target individual age-restricted variations without gating their sibling variations
• Four-tier age resolution: store default → gated category override → parent product override → variation override
• Test and production environments with separate API keys
• Popup and redirect verification flows
• Optional delivery outside Denmark without MitID, with server-side destination checks
• Accessible age-verification interface with the documented official MitID CTA
• Danish and English storefront strings; admin UI fully translatable
• WPML and Polylang compatible
• Site-specific API keys and settings; Multisite compatibility has not been verified

The plugin provides technical age verification. Merchants remain responsible for their product rules, delivery destinations and applicable requirements.

External services and data

Aldersverificering.dk / UNQVerify

This service starts the MitID verification flow and returns a signed verification result. After you configure an API key, the customer’s browser contacts api.aldersverificering.dk or test.api.aldersverificering.dk when verification starts. The request sends the store’s public API key, the required age and the store callback URL (/unqverify/callback/). The API returns the broker authorization URL, which opens in a popup or redirects the browser. The customer completes authentication with the configured MitID broker, and the result returns to the store callback.

The browser and WordPress server also request public signing keys from the corresponding API host at /well-known/openid-configuration/jwks to validate verification tokens. The service processes the verification result, age-related claims and technical session/event identifiers; its event history supports operation and service billing. These requests also expose connection information, such as the requesting IP address, and browser-supplied headers to the receiving host. The plugin does not send the cart contents, order number or shipping/billing address in the verification-start request.

See the service website, pricing and Privacy Policy. Contact the service provider at info@aldersverificering.dk for the applicable service terms before enabling production.

Bundled SDK and readable source

The service SDK (version 0.4.3) is included in this plugin and served from the store’s own WordPress installation, with Subresource Integrity verification. It loads on gated cart/checkout pages when the plugin initializes verification, and on the callback page. No external CDN request is needed to download the SDK. The plugin’s CSS, MitID logo and font are also served locally.

The exact TypeScript source, locked dependencies, build instructions and MIT license notices for the SDK and its bundled dependencies are included under assets/vendor/unqverify-sdk/source/. See BUILD.md in that folder to reproduce the distributed JavaScript. The bundled SDK is byte-identical to the previously used 0.4.3 distribution; the verification API remains an external service as described above.

Browser and store storage

After successful verification, the SDK stores the signed result in the unqverify_token cookie on the store domain. The plugin reads this token to check the verification result, required age and expiry. It does not write the JWT to the WordPress database. When the optional foreign-delivery setting is enabled, it records whether the delivery check ran, the satisfied age requirement and a hash of the active public key on the order, allowing a valid order to retry payment after the browser token expires. Order verification metadata is retained when the plugin is deleted; plugin settings, targeting metadata and signing-key caches are removed when no other known installation copy remains. Merchants should describe this integration in their own privacy information.