Overview
Konfirm is a Shopify app that automatically verifies Cash on Delivery (COD) orders before they ship. When a customer places a COD order, Konfirm immediately sends them a 6-digit OTP via SMS and/or Email. The customer enters the OTP on the Shopify thank-you page or via the link in the message to confirm or cancel their order.
The result is tagged in real time on the Shopify order — cod-confirmed or cod-cancelled — so your fulfilment team always knows which orders are safe to ship.
Key benefits
- Reduce Return-to-Origin (RTO) losses from unverified COD orders
- Built-in SMS (Twilio) and Email (Resend) — no setup needed. Optionally bring your own provider.
- Two verification paths: Shopify checkout extension + standalone OTP page
- No change to your store's checkout or theme required
- Embedded dashboard in Shopify admin — no separate login
Installation
Install from Shopify App Store
Click Add app on the Konfirm listing page. You'll be redirected through Shopify's OAuth flow to grant the required permissions (read_orders, write_orders).
Configure your SMS provider
Go to Settings → SMS and enter your MSG91 API key or Twilio credentials. See SMS Providers for details.
Configure Email (optional but recommended)
Go to Settings → Email and enter your SMTP credentials. Konfirm will send OTP emails from your own domain. See Email (SMTP) for details.
Enable the checkout extension
In your Shopify admin, go to Online Store → Customize → Thank you page and add the Konfirm COD Verify block. This shows the OTP input widget directly on the order confirmation page.
orders/create and app/uninstalled webhooks automatically during installation. You don't need to configure anything in Shopify manually.
Requirements
| Requirement | Details |
|---|---|
| Shopify plan | Any paid Shopify plan (Basic and above) |
| SMS | None required — Konfirm includes built-in SMS via Twilio. Optional: bring your own MSG91 or Twilio account. |
| None required — Konfirm includes built-in email via Resend. Optional: configure custom SMTP for your own domain. | |
| COD gateway | A Shopify payment method configured for COD / Cash on Delivery |
| Checkout extension | Online Store 2.0 theme (required for the OTP widget on the thank-you page) |
SMS Providers
By default, Konfirm sends SMS via its own built-in Twilio account. No setup is required — install the app and OTPs go out immediately.
If you want to use a custom sender ID, a DLT-approved template (India), or your own Twilio billing, enable Use your own SMS provider in Settings → SMS and enter your credentials below.
MSG91 (optional — India recommended)
Recommended for high-volume SMS in India. Required if you need a DLT-approved sender ID.
| Field | Where to find it |
|---|---|
| API Key | MSG91 dashboard → API → Auth Key |
| Sender ID | Your DLT-approved sender ID (e.g. MYSHOP) |
| Template ID | Your DLT-approved template ID (required for India) |
Twilio (optional — bring your own account)
Use this if you want OTPs billed to your own Twilio account or need a specific Twilio number.
| Field | Where to find it |
|---|---|
| Account SID | Twilio console → Dashboard → Account Info |
| Auth Token | Twilio console → Dashboard → Account Info |
| From number | Your Twilio phone number or Messaging Service SID |
By default, Konfirm sends OTP emails via its own built-in Resend mailer (from noreply@konfirm.pacificsoftwares.com). No SMTP setup is required.
To send emails from your own domain (e.g. orders@yourstore.com), enable Use custom SMTP in Settings → Email and fill in the fields below.
| Setting | Description |
|---|---|
| SMTP Host | Your mail server hostname, e.g. smtp.gmail.com |
| SMTP Port | 587 (TLS) or 465 (SSL). Default: 587 |
| Encryption | tls, ssl, or none |
| Username | Your SMTP login (usually your email address) |
| Password | Your SMTP password or app-specific password |
| From address | e.g. orders@yourstore.com |
| From name | e.g. YourStore Orders |
Common provider settings
Message Templates
Both the SMS body and the email body are fully customisable from Settings → Templates. Use the variable placeholders below to personalise each message.
Default SMS template
Available variables
| Variable | Example value | Description |
|---|---|---|
| {name} | Aarav Sharma | Customer's first name |
| {order} | #1043 | Shopify order number |
| {amount} | 1,299.00 | Order total, formatted |
| {currency} | INR | Order currency code |
| {otp} | 482917 | The 6-digit OTP code |
| {verify_url} | https://…/verify/t4x… | Direct link to the OTP entry page |
Retry Logic Pro
On the Pro plan, Konfirm will automatically re-send the OTP if the customer hasn't responded after a configurable delay.
| Setting | Default | Range |
|---|---|---|
| Retry count | 1 | 0 – 3 |
| Retry delay | 30 minutes | 15 – 120 minutes |
If all retries are exhausted and the order is still unverified after 24 hours, the order status is set to expired and tagged cod-expired in Shopify.
Auto-cancel on Rejection Pro
When enabled, Konfirm will automatically call the Shopify Cancel Order API the moment a customer chooses to cancel via the OTP page. This removes manual work for your team.
- The cancellation reason is set to
customerin Shopify - Shopify's default cancellation email is suppressed — Konfirm has already notified the customer
- A note is added to the order timeline: "Cancelled by customer via Konfirm COD verification"
Order Flow
Here is the complete lifecycle of a COD order through Konfirm:
- Customer places a COD order on your Shopify store.
- Shopify fires an
orders/createwebhook to Konfirm within seconds. - Konfirm validates the order is COD, checks the free-plan limit, and queues a background job.
- The job creates a
CodOrderrecord and a unique 6-digit OTP token (valid 24 hours). - A second job fires 15 seconds later and sends the OTP via SMS and/or Email.
- The customer enters their OTP on the thank-you page or the verification link.
- On success, the order status is updated atomically and the Shopify order is tagged.
Order status values
| Status | Shopify tag | Meaning |
|---|---|---|
pending | — | OTP sent, waiting for customer response |
confirmed | cod-confirmed | Customer entered correct OTP and chose Confirm |
cancelled | cod-cancelled | Customer entered correct OTP and chose Cancel |
expired | cod-expired | OTP expired after 24 hours with no response |
OTP Verification
Customers can verify their order via two paths:
Path 1 — Shopify thank-you page
The Konfirm checkout extension injects an OTP entry widget on the Shopify order confirmation (thank-you) page. The widget polls for the OTP in the background and shows the entry form once the OTP is ready (typically 15–30 seconds after checkout).
Path 2 — Verification link
The SMS and email both contain a direct link (/verify/{token}). Tapping the link opens a mobile-optimised page where the customer types their OTP and clicks Confirm or Cancel.
OTP security
- OTPs are 6-digit numeric codes, generated securely per order
- Each OTP is valid for 24 hours and single-use
- After 5 incorrect attempts the token is locked
- Non-numeric or wrong-length inputs are rejected before consuming an attempt
- Confirmation is atomic — two simultaneous submits cannot both succeed
Checkout Extension
Konfirm includes a Shopify checkout extension that renders an OTP entry widget on the purchase.thank-you page. No theme code changes are required.
Activating the extension
- In your Shopify admin, go to Online Store → Themes → Customize
- In the page selector, choose Order status / Thank you
- Click Add block and search for Konfirm COD Verify
- Add and position the block, then click Save
How the widget works
After checkout, the extension polls /api/checkout/status every 2 seconds until the background job has generated the OTP (usually within 15–30 seconds). Once ready, the OTP input form appears. The customer enters their code and clicks Confirm or Cancel.
Free Plan
- 30 COD confirmations per month, per store
- SMS via MSG91 or Twilio (your own credentials)
- Email via any SMTP
- Real-time order tagging
- Dashboard
- No retry logic, no auto-cancel
The counter resets on the 1st of each calendar month. When the limit is reached, new COD orders are not processed until the counter resets or you upgrade to Pro.
Pro Plan
- Unlimited COD confirmations
- Smart retry logic (up to 3 retries, configurable delay)
- Auto-cancel on rejection
- Custom SMS and email message templates
- Priority support
- 7-day free trial
Billing is handled by Shopify's recurring app charge — you can upgrade and cancel directly from your Shopify admin at any time.
COD Detection
Konfirm identifies COD orders by inspecting the gateway field on the Shopify order payload. Orders are treated as COD if the gateway value matches any of the following:
If you use a custom COD gateway name, contact support to add it to your detection rules.
Webhooks
Konfirm registers the following webhooks automatically on install. All are verified with Shopify's HMAC signature.
| Topic | Purpose |
|---|---|
orders/create | Triggers COD detection and OTP dispatch |
app/uninstalled | Marks the shop as uninstalled, revokes access token |
customers/data_request | GDPR — emails customer data export to shop owner |
customers/redact | GDPR — anonymises customer PII in Konfirm database |
shop/redact | GDPR — deletes all shop data 48 hours after uninstall |
200 OK immediately and process the payload asynchronously via a background queue. This ensures Shopify never retries due to a slow response.
GDPR Compliance
Konfirm implements all three Shopify-mandatory GDPR webhooks:
customers/data_request
When Shopify sends a data request for a customer, Konfirm emails a summary of all COD order records held for that customer (order number, amount, status, date) to the shop owner's registered email address.
customers/redact
Anonymises customer_phone, customer_email, and sets customer_name to [redacted] for all matching COD orders within that shop. The scope is strictly limited to the requesting shop — no cross-shop data is affected.
shop/redact
Deletes all data for a shop (including COD orders, SMS attempts, tokens, and settings) 48 hours after uninstall. Only triggers if the shop has an uninstalled_at timestamp — active shops are never affected.
FAQ
Does Konfirm work out of the box without any configuration?
Yes. Konfirm includes built-in SMS (via Twilio) and built-in email (via Resend). Install the app, add the checkout extension to your theme, enable COD as a payment method, and you're done. No API keys or SMTP setup needed unless you want to use your own provider.
What happens if the SMS fails to deliver?
Konfirm logs every SMS attempt. If the SMS provider returns an error, the job is retried up to 3 times with a 2-minute backoff. If all retries fail, the attempt is logged as failed and you'll see it in the Dashboard. Email is sent independently as a fallback.
Does Konfirm work with headless / custom storefronts?
Partially. The webhook-based OTP dispatch works for any Shopify store regardless of storefront. The checkout extension (OTP widget on the thank-you page) requires Shopify's native checkout and Online Store 2.0. For headless storefronts, customers use the link in the SMS/email to verify.
Will it interfere with my existing order automations?
No. Konfirm only reads orders via the webhook and writes order tags. It does not modify order status, payment status, fulfilment status, or any other Shopify order field beyond tags.
Can I change the verification link domain?
The verification link uses your Konfirm app URL. Custom domain support is on the roadmap.
Contact & Support
Have a question not covered here? We're happy to help.
- Email: hello@pacificsoftwares.com
- Response time: within 1 business day