
Integrating Age Verification: API vs WordPress Plugin
AgeOnce Team
When to use a direct API integration and when a WordPress or WooCommerce plugin is enough.
How you integrate age verification depends on your stack and who maintains it. Two common patterns are a direct API integration and a ready-made plugin for WordPress or WooCommerce.
API integration. You redirect the user to the age verification provider (e.g. via OAuth-style flow with client_id and redirect_uri). The user completes verification; the provider redirects back with an authorization code. Your backend exchanges the code for a JWT or signed token (and optionally an Audit ID). You then grant or deny access based on the token. This fits custom apps, headless front ends, and any platform where you control the backend. You get full control over when to trigger verification, how to cache or refresh tokens, and how to pass the result to your business logic.
WordPress / WooCommerce plugin. If your site runs on WordPress and you need to gate content or purchases (e.g. alcohol, age-restricted products), a plugin can handle the redirect, callback, and token validation. The plugin typically checks for a valid age verification result (and perhaps an Audit ID) and then allows access to the page, product, or checkout. Best for teams that prefer minimal code and quick deployment. Ensure the plugin is maintained and that it does not store more user data than necessary (e.g. only the verification outcome and audit ID, not raw tokens or PII beyond what you need).
Hybrid. Some providers offer both: an API for full control and a plugin for WordPress. You might start with the plugin for a marketing or e‑commerce site and add API integration later for a custom app or forum. In all cases, prefer a solution that returns only a verification outcome and audit trail, so your integration stays simple and compliant.
This is what we solve with AgeOnce
18+ token and Audit ID only, with no document or face storage
Returning users re-verify with a quick face check across your and partners’ sites
One integration for UK, EU, US, Australia (DSA, GDPR, Ofcom, ICO ready)
Prove compliance to regulators without holding sensitive data
Recent Posts

ICO Fines and the March 2026 Open Letter: Reddit, MediaLab, and Big Tech on Notice
The UK ICO has fined Reddit and MediaLab for age-assurance failures and sent an open letter to major platforms. What it means for compliance.

On-Device Age Verification: When Your Face Never Leaves Your Phone
How age verification can run entirely on the user’s device so that no face image or biometric data is sent to servers.

The 'Age Verification Trap': Can Platforms Comply Without Collecting Biometrics on Kids?
Regulators demand age checks, but collecting biometrics from minors triggers privacy concerns. How to navigate the trap.