PallasMark – Video Proof & Buyer Approval for WooCommerce

PallasMark helps WooCommerce teams document packing with photo or video evidence. An authorized
staff member manually captures proof in the PallasMark workflow while an order is being packed,
then the merchant can optionally share a completed proof with the buyer.

The evidence can help a merchant respond to an “item not as described” claim, delivery question,
return, or chargeback. It does not guarantee a dispute outcome, delivery, or recovery of funds.
PallasMark does not automatically capture every order and does not make shipping, refund, or
chargeback decisions for the store.

This plugin connects the WooCommerce store to PallasMark with a one-time connect token. After the
merchant clicks Connect to PallasMark, it registers the order webhooks that send order activity
to the configured PallasMark service. The plugin also provides the WooCommerce-side settings and
evidence views; capture and optional buyer sharing happen in the PallasMark workflow.

What this plugin does:

• Adds a WooCommerce → PallasMark settings page.
• Connects the store with a one-time token and registers order.created / order.updated
  webhooks through WooCommerce’s modern REST API (wp_api_v3).
• Re-registers only PallasMark/drProof webhooks, replacing stale copies instead of creating
  duplicates.
• Adds a read-only PallasMark evidence panel to classic and HPOS WooCommerce order screens.
• Shows proof and return-evidence status and links on customer order views when PallasMark has
  written a buyer-visible link; stores can also use [pallasmark_order_evidence].
• Supports authenticated exact lookup for order numbers, tracking values, product SKUs, and
  barcodes, with a bounded local alias index and SHA-256 lookup hashes.
• Shows local webhook health and a nonce-protected re-register action.

What this plugin does not do: it does not capture media automatically, guarantee a successful
chargeback or dispute response, stop an order from shipping, issue a refund, or decide whether a
buyer is right. Any buyer decision or shipment gate depends on the configured PallasMark workflow
and the merchant’s process. Sharing evidence with a buyer is an optional merchant action.

After connecting the store, click Connect WooCommerce inside PallasMark (Integrations) to grant
the read/write REST keys needed for PallasMark to write proof status and links back onto orders.
The webhook connection lets order data flow in; the REST keys enable write-back.

External service disclosure: PallasMark is a hosted Software as a Service product. This plugin
talks to it in two distinct ways:

1. Support telemetry (optional). It is off by default. If a store manager opts in, at most once
   every 24 hours the plugin sends this site’s public URL and plugin/WordPress/WooCommerce version
   numbers. It sends no order, customer, or product data and can be turned off at any time.
2. Store connection (explicit, your click). After you paste a connect token and click
   Connect to PallasMark, the plugin exchanges the token and store URL for a webhook secret and
   configures WooCommerce order webhooks. Those webhook payloads can include customer, billing,
   shipping, product, and order-status data for real order activity.

Use of the service is subject to the
PallasMark Terms of Service and
Privacy Policy.

Privacy

This plugin sends data to the PallasMark URL configured on its settings page (the default is
https://app.pallasmark.com) in the situations described above:

• Only after optional support telemetry is enabled: a throttled daily heartbeat containing this
  site’s URL (home_url()) and plugin/WordPress/WooCommerce version numbers only.
• After you click “Connect to PallasMark”: the one-time token exchange and, while connected,
  WooCommerce order webhook payloads that can include order/customer data.
• When PallasMark searches after a scan: the scanned identifier is sent in an authenticated
  request body. The plugin’s local lookup table stores only its SHA-256 hash; the identifier is
  not put in request URLs or stored as plain text by the index.

Deactivation, uninstall, and the explicit Disconnect action remove this plugin’s WooCommerce
webhooks and local connection credentials, stopping new order delivery. Existing evidence in
PallasMark is retained. Uninstall also removes the optional telemetry preference.

1. Install this plugin from the WordPress plugins screen or upload it to
   /wp-content/plugins/pallasmark-for-woocommerce.
2. Activate it and open WooCommerce → PallasMark.
3. Click Log in to PallasMark. If you do not have an account, create one from that login flow.
4. In PallasMark, generate and copy the one-time connect token.
5. Return to WordPress, paste the token, and click Connect to PallasMark.
6. In PallasMark → Integrations, click Connect WooCommerce to enable proof status and link
   write-back.

1. 

   Legacy settings-page mockup before webhook registration: a PallasMark endpoint field and Register webhooks button are shown. A replacement capture of the current connect-token flow is pending.

2. 

   Legacy post-registration mockup showing a sample webhook secret and Connect WooCommerce instructions. It reflects the retired secret copy flow; a replacement current-flow capture is pending.

1.0.13

• Shows completed packing evidence in the WooCommerce administrator order panel before optional
  buyer sharing, using an authenticated PallasMark evidence/history link.
• Indexes native product and variation GTIN/SKU/barcode values, refreshes affected orders after
  product edits, and reports progressive backfill coverage for large order histories.
• Adds a side-effect-free authenticated write-permission probe for connection verification.
• Restricts PallasMark endpoints to the trusted HTTPS service origin, disables redirects for
  credential-bearing requests, makes support telemetry opt-in, and removes local webhooks and
  revokes the PallasMark Woo API key on disconnect, deactivation, or uninstall.

1.0.12

• Adds exact barcode, SKU, tracking, and order-number lookup through the authenticated PallasMark
  endpoint, with bounded backfill for older WooCommerce orders and no identifier in request URLs.
• Keeps the local alias index current when orders change or are deleted and supports HPOS order
  objects without requiring legacy post tables.

1.0.11

• Reworks the listing copy around WooCommerce packing proof, order evidence, buyer approval, return
  evidence, and chargeback-dispute documentation.

1.0.10

• Clarifies that connect tokens expire after 10 minutes and can be used only once.
• Adds a specific message when a WooCommerce store is already connected to another PallasMark
  account.

1.0.9

• Adds a read-only PallasMark evidence panel to classic and HPOS WooCommerce order screens.
• Adds proof and return-evidence status/links to customer order views and the order-received screen,
  with the [pallasmark_order_evidence] shortcode for custom placement.
• Adds ownership and order-key checks for customer-facing evidence links, webhook health visibility,
  and a nonce-protected idempotent re-register action.

1.0.8

• Adds a lightweight install ping on activation, deactivation, and a throttled daily heartbeat,
  sending only the site’s URL and version numbers; the data transfer is disclosed in Privacy.
• Simplifies the installation flow and updates the listing copy for WooCommerce search terms.

1.0.7

• Sends the “New here?” path through the PallasMark login screen so existing users do not create a
  duplicate account; login still offers account creation for new users.
• Clarifies the connection steps with a numbered flow.

1.0.6

• Adds a path for a new WordPress.org visitor to create a free PallasMark account with this store
  URL attached.

1.0.5

• Replaces the unusable plugin-generated-secret flow with a one-time PallasMark connect token.

1.0.4

• Declares WooCommerce as a required plugin dependency.

1.0.3

• Confirms compatibility with WordPress 7.0 and WooCommerce 10.9.
• Adds external-service, data-transfer, Terms of Service, and Privacy Policy disclosure.
• Fixes translation-domain declarations and updates the plugin homepage to PallasMark.

1.0.2

• Expands the plugin title to include the WooCommerce video-proof and buyer-approval use case.

1.0.1

• Renames the plugin from drProof for WooCommerce to PallasMark for WooCommerce.
• Fixes the default endpoint and cleans up old drProof webhook names during re-registration.
• Adds translator-ready strings.

1.0.0

• Initial release.