Reviewer Test Mode

Reviewer Test Mode allows the VerifyHuman Shopify app to be fully demonstrated during Shopify App Review without requiring real identity documents, selfies, or a live VerifyHuman API subscription.

How It Works

When Test Mode is active for a specific shop, all verification API calls use a pre-configured test API key instead of the merchant's real key. The test key produces simulated (mock) responses that always pass verification. No real biometric data is processed.

Key Behaviors in Test Mode

• Age Verification: Returns a successful result with simulated age estimation.
• Identity Verification: Returns a successful match with simulated confidence score.
• Human Check: Returns a PASS status with a simulated token.
• All API responses include test_mode: true and provider: "mock" fields to clearly indicate simulated data.
• Log entries are tagged with [TEST MODE] for easy identification.

Configuration

Test Mode is controlled by three environment variables on the server:

All three must be set for test mode to activate. Test mode only applies to the specific shop domain specified in TEST_SHOP_DOMAIN.

Activation Logic

Test mode activates when all of the following conditions are met:

1. VERIFYHUMAN_TEST_MODE is "true".
2. TEST_SHOP_DOMAIN is set and matches the requesting shop's domain.
3. VERIFYHUMAN_TEST_API_KEY is set (an error is thrown if test mode is enabled but this key is missing).

For any other shop domain, the app operates normally using the merchant's own API key.

Diagnostics Indicator

When test mode is active, the Diagnostics endpoint includes additional information:

• A test_mode: true field in the response.
• A dedicated diagnostics check: "Reviewer Test Mode is active. All verification calls use a mock API key with simulated responses. No real ID documents are required."
• A reviewer_notes field explaining that all verification flows use simulated responses.

This allows Shopify reviewers to confirm that the app is operating in a safe test environment.

What Reviewers See

During app review with test mode active:

1. Age Gate: The overlay appears and can be completed. If selfie is required, any image submitted will result in a pass. The response will include test_mode: true.

2. Identity Verification: The ID document upload and selfie capture flow works end-to-end. Submitted images are sent to the VerifyHuman API using the test key, which returns simulated success results.

3. Human Check: Form protection activates normally. The selfie verification returns a pass with a simulated token.

4. Dashboard: All features are functional. Logs show [TEST MODE] annotations. The diagnostics card shows a test mode indicator.

Security Considerations

• The test API key is stored as a server-side environment variable and is never exposed to the storefront or browser.
• Test mode only applies to the single shop domain specified in TEST_SHOP_DOMAIN. All other shops are unaffected.
• The test key should be a dedicated VerifyHuman test key, not a production key.
• Test mode responses are clearly marked with test_mode: true to prevent confusion with real verification results.
• If VERIFYHUMAN_TEST_MODE is "true" but VERIFYHUMAN_TEST_API_KEY is not set, the server throws an explicit error: "Test mode is enabled but VERIFYHUMAN_TEST_API_KEY is not configured".

Disabling Test Mode

After Shopify app review is complete:

1. Set VERIFYHUMAN_TEST_MODE to "false" (or remove it).
2. Optionally remove TEST_SHOP_DOMAIN and VERIFYHUMAN_TEST_API_KEY.
3. Restart the application.

The app will resume normal operation, requiring merchants to use their own VerifyHuman API keys.

Summary