Your customer just paid $250 for something you spent three days making. The first thing they get is an order number, a total, and “thank you for your purchase” — the same email that confirmed their printer ink last week.
Digital Unboxing & COA Kit closes that gap. Instead of the generic confirmation, the buyer gets a guided, one-screen-at-a-time digital unboxing: their piece front and center, a personal note in the maker’s own words, a care guide for that exact piece, and a certificate of authenticity with their name, edition number, and a scan-to-verify QR code already on it.
Happy to answer questions on how it fits into an existing order flow — would genuinely love to hear from other makers here on whether this solves a real problem for you.
This is a clean pitch — congrats on getting through review. A couple of things I’m curious about:
How are you handling the “scan-to-verify” QR piece from a security angle — is there anything stopping someone from just screenshotting or copying a valid QR/edition combo, or is the verification tied to something server-side that’s harder to spoof?
Also, on the delivery mechanism — is the guided unboxing screen replacing the standard order confirmation email, or is it a separate link/page the buyer gets sent to afterward? Asking because the per-product-vs-per-store templating limit came up in another thread here recently, and I’m curious how you worked around it (or didn’t need to).
Would genuinely be curious to see the demo if you’re sharing it.
Thanks! Questions like these are exactly the kind I like getting, so happy to go deep.
On the QR/verification side: nothing about the certificate is actually encoded in the QR itself, it just points to a URL with a long random token (48-character hex, generated with crypto.randomBytes, so not sequential or guessable). That URL resolves live against my database every time it’s scanned, so the “verification” is genuinely server-side. There’s no way to mint a valid-looking token/edition combo without going through my actual order pipeline. Where I’ll be honest with you rather than oversell it: like basically every passive QR-based COA system on the market right now (mine included, and this goes for my closest competitor too), a real QR code can in principle be photographed and reprinted onto something else, since it’s not chip-paired or single-use. That’s a limitation of the whole category, not something specific to my implementation. Proper anti-cloning would mean NFC/RFID or single-use scan invalidation, which is a real roadmap idea but not in what’s shipped today. So: forging a fake certificate from scratch, no; physically copying a genuine tag, that’s the same open question everyone in this space has.
On delivery, good instinct to ask, because that templating limit is real and I ran into it directly. Shopify only gives you one order-confirmation template per store, not per product, so rather than fight that, I sidestepped it entirely: the standard Shopify confirmation email still fires as normal, and my app sends its own separate transactional email the moment the order webhook lands (own domain, via Resend), with a personalized link to a hosted page. That page is the actual guided unboxing experience: full-screen, one stage at a time, tissue-paper reveal animation, real PDFs rendered live (the piece, a personal note, care, an upsell, returns, then the certificate with the QR). Merchants can set it to auto-send the instant an order comes in, or hold it for manual review before sending. So it’s additive rather than a hack on the native email, which turned out to be the cleaner path anyway.
Hi @cl-apps Welcome To Shopify Community So This addresses a real emotional gap for handmade/premium sellers specifically, a generic order confirmation genuinely undersells the effort behind a $250 handmade piece, and buyers of that kind of product usually do care about provenance/authenticity more than typical impulse-buy customers. The scan-to-verify QR with edition number is a nice touch for anything limited or numbered, that adds resale/collector value beyond just the unboxing moment itself. Curious how it handles order edits or refunds though, since once a certificate with a name and edition number is issued, does cancelling or refunding an order automatically void/update that record, or does that need manual handling on the seller’s end? Hope this helps solve your problem, and if it does, don’t forget to like and mark it as the solution. Thank you
Hi there Mustafa, we have a feature on the merchant dashboard that allows the merchant to void any previous coa if the item was returned, edited or refunded. That also voids the QR code and deletes the URL where the product details live!
Hi @cl-apps So That’s a smart safeguard, deleting the URL entirely rather than just marking it invalid means there’s no lingering link floating around that could confuse a buyer or someone who received the item secondhand. Is the voiding a manual step the merchant has to remember to do, or does it eventually hook into Shopify’s refund/return events automatically? Manual steps are usually where things get missed during busy periods, so automatic triggering off a refund event would make this airtight rather than relying on merchant follow-through.
Appreciate the straight answer on the cloning question — a lot of people in this space would’ve oversold that as “solved.” Server-side token resolution against your DB is the right way to handle the verification part, even if the physical-copy problem is genuinely unsolved industry-wide right now.
The separate-email-via-own-domain approach makes sense, and cleaner than I expected — leaves the native confirmation alone so there’s no risk to Shopify’s own delivery track record, and you keep full control over your own send. Did Resend’s deliverability hold up compared to what Shopify’s own transactional email gets, or was that not really a concern given it’s a distinct, expected second email rather than something that could get flagged as duplicate/spammy?
Still curious about that demo if it’s shareable — no worries if it’s not public yet.
