Order token for the star widget

1. 1The customer completes a purchase.
2. 2Your server creates an order token from the order number and your API key.
3. 3The thank-you page shows the star widget with the token in data-order.
4. 4The customer writes their review, and we check the token.

The token must be created on the server, so nobody can forge it in the browser. Never put the API key in the code on your website.

The token consists of four parts separated by full stops: the prefix from the key, the order number in base64url, the time in Unix seconds and a signature.

The signature is HMAC-SHA256 in base64url of the text order-token, the prefix, the order number and the time, separated by full stops, using the secret from the key.

Under Settings, API and webhooks in the dashboard you'll find Order token for the star widget with ready-made examples in Node.js and PHP.

• The token is valid for 90 days.
• If the order has been cancelled or refunded, the token doesn't give the label.
• If the token is invalid, the review is still saved, just without the label.

• The label doesn't appear: Check that the token was created with an active key, and that it's no older than 90 days.
• If you revoke the key, tokens created with it no longer work.

See also Verified purchase.