Skip to main content

Deeplink format

https://www.doordash.com/rx/{merchant_tag}?store_id=...&item=...&signature=...
IMPORTANT NOTE

Merchants should not, under any circumstances, provide DoorDash with any identifying patient data or Protected Health Information related to the prescription order within the deeplink.

Path parameters​

ParameterTypeRequiredDescription
merchant_tagstringYesThe unique pharmacy identifier for the merchant.

Query parameters​

ParameterTypeRequiredRepeatableDescription
store_idstringYesNoThe unique identifier for the merchant's store.
itemstringYesYesEncodes the prescription details in the format: <prefix>:<copay>:<expiry>.
signaturestringYesNoThe signature of the URL; see signature Details.

item parameter format​

<3-letter prefix>:<copay in cents>:<expiration in unix time (seconds)>
ComponentDescription
prefixThe first 3 letters of the prescription name.
copayCost in cents. Example: 500 = $5.00.
expirationUnix timestamp for expiration (in seconds). Example: 1749225600.

signature details​

  1. The merchant will generate a RSA key pair and provide DoorDash with the public key.
  2. The merchant will hash (SHA-256) the url path beginning with the <merchant_tag> up to the end of the last non-signature parameter.
  3. The merchant will sign the URL by encrypting the hash with their private key.
  4. The resulting string is to be used as the value of the signature parameter.

Example​

The following deeplink will be used as an example.

https://www.doordash.com/rx/abc?store_id=123&item=PRO:500:1749225600
&signature=BIp4wikYQLfkUusg30p95diNK1xoJsBY1+WVP2+/FXB6BfQE54Pui1iff
u2ByYwfqAf9AxMGYza4trQSTGTYNLpcsbUtHBt77fellBRK0ATxeIxMrJAyXQJ482Kl3
odvR49VuM/ebyx+oHiUuBVYMuHK9MgvdkmAu2kZQvCpXQooyfWBADqQKIBn0yxIDsDtb
bRbyxjf5AxP1qguxsTPLr5N8cFv5Uo056qs83h1iXjf2SsYNTVA02RPF9deCljsdgMSd
xrkLVletsq/UFUx33d+/fvcj1dg2WTKdiUzhOTfD2s5h8HoG2mCIWp5+8gKl+SXBjIzs
2Yy7vAJurtoww==

The deeplink contains the following information:

ParameterValueExplanation
merchant_tagabc
store_id123
itemPRO:500:1749225600This item corresponds to a prescription beginning with PRO, has a $5.00 copay, and expires at Unix timestamp 1749225600 (which is June 6, 2025, 12:00 PM ET)
signatureBIp4wikYQLfkUusg30p95diNK1xoJsBY1+WVP2+/FXB6BfQE54Pui1iffu2ByYwf
qAf9AxMGYza4trQSTGTYNLpcsbUtHBt77fellBRK0ATxeIxMrJAyXQJ482Kl3odv
R49VuM/ebyx+oHiUuBVYMuHK9MgvdkmAu2kZQvCpXQooyfWBADqQKIBn0yxIDsDt
bbRbyxjf5AxP1qguxsTPLr5N8cFv5Uo056qs83h1iXjf2SsYNTVA02RPF9deCljs
dgMSdxrkLVletsq/UFUx33d+/fvcj1dg2WTKdiUzhOTfD2s5h8HoG2mCIWp5+8gK
l+SXBjIzs2Yy7vAJurtoww==		See How the signature was generated for an explanation.

How the signature was generated​

For the purposes of this example, we will use the following key pair.

Public Key​

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApPukzemmUu6vGhxQxRMo
MOdxM0+4JYM5mIXl+Ob7aXnm390bZ9AdFMbf4T5Rsr8siC7Gxvt20Pq3tt6fO/Eh
8RPneg/l1QaHptpRwNoh9WCB4gGf47pc4CwDwa/74UzVEy75I8cNWENvPqF3jkBH
N1BT+6ylpUvgwNALVCaP0w79pMf/VEYZDMFaV+k8klwIcRgV9R4cXMpmhI8j7y2W
hZmxJfM888Pn8uPT+pPeeJxvyJ3VshVBhJlPMPXEWV1/RNVh+d3gL6FY70nOpuYR
qe9eLxj+bJMvrumCdY4G/h1bZpxcSEjp8y1nYHa1v5unM4KUbMuT+J8kgMcpcveU
2QIDAQAB
-----END PUBLIC KEY-----

Private Key​

-----BEGIN RSA PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCk+6TN6aZS7q8a
HFDFEygw53EzT7glgzmYheX45vtpeebf3Rtn0B0Uxt/hPlGyvyyILsbG+3bQ+re2
3p878SHxE+d6D+XVBoem2lHA2iH1YIHiAZ/julzgLAPBr/vhTNUTLvkjxw1YQ28+
oXeOQEc3UFP7rKWlS+DA0AtUJo/TDv2kx/9URhkMwVpX6TySXAhxGBX1HhxcymaE
jyPvLZaFmbEl8zzzw+fy49P6k954nG/IndWyFUGEmU8w9cRZXX9E1WH53eAvoVjv
Sc6m5hGp714vGP5sky+u6YJ1jgb+HVtmnFxISOnzLWdgdrW/m6czgpRsy5P4nySA
xyly95TZAgMBAAECggEARjhtHs9R4X6BvMVMg3Tx6E652bMWl7DQtOBYz6XQYEZo
Q+QiI/9qQUucQox5zXCdDaGLLWoeWjg8NXNvpt2tKqTkIwndMtxCpHvLzB+L0Jqw
7XbvjMfne+p/9tJmjLBdCHs3w0iXn3ekQ64J6tvk8+AWvsnu/vnawXZLPBflo1jQ
7/SxNKY4rARXcb7N94l26fN092U+1xK+G9AGhbpCi4RfVflntretgSdQYSHE4onW
gtt7lgSpdxO9V3XUn1bmsRBotjmFeRQJNNTfA86ZKTUZea5WQzXw3goj7LMZgxzq
6NwDLRFi82ZF+zc7n07qhycdCjr3G98zWJShLK1hmQKBgQDXHMxthF9UrZC+6U0m
clrxIQZ4Kcf1C2UV1Flj3L/oiXRr6U6DJAf8v2OIR61/ZK1AiWq+/B9vhHyCKF5t
dX7xNoyUi3TFe9cPCelAuKPytUGdQQqYN2UPCjEZsNJPlHx1g7K9N5T51KuzzyR7
p/FmZTMhO6hSFZmLoT8XGoUQGwKBgQDEV5VbboOU8JcpoQd3jSGTXNKAtjniaNuH
uwBoMIYW7HY6OHhT1C59aTzYON+GVjoHBjTrj/HADSucFmuUcVZXNfVOhIIR9bCb
a/5WTubnsKbmn9P+Vv0U6iYZqxA0GPjIUXUe3NNvcSYdWnb3YnnVaLMBvpU2aDkE
axYbQQ7GGwKBgQCM21y5ce6Cokyf1mEghc0rC/cShDldKiL9ElmeXJSFjkxfxRwW
H2fjhueD+3uOabxRACqX+LwU5+onyItcnY2MIa4YLuE914PRYyoLqVwht7LJaCep
2Mwh9wiDzBdK6O4+fQhzgovYs/vi+AbpueUGqcm7PzdO2Ln8ho+rb0AmdQKBgBIg
C7evEhKTy0CajvfoXWsfLIeZSuqtx2ZWSwlTQW2oUpm5UNJcShZluqozRd8+4oh3
eDcuyKB0FsyH/VJszA2s+4JOFTvXNICEjawmCIbm9eFga8+U9DQUEYRZGFvW2lCT
xH4e4J3vEhevnD/mJV0gFzZYA6pMIMdZo2bMsLJ1AoGAJxaNFb5dc/Av0og1EO0j
1L03yRzR4Mgz0QCj2FLR5+gtX4lWfPFemic41mWqVXgooxvgceCNzK99AhmNUzky
tOzvayOxJ3gAMNskX47vv5dNlsfHyR3T1L5lkLL79sbWjipquZaCzKRCYz4ehwk3
L9fW+XR72QABmt2ALa1BoeI=
-----END RSA PRIVATE KEY-----

Process​

  1. The string to be hashed is abc?store_id=123&item=PRO:500:1749225600.
  2. The SHA-256 hash of this string is a9bcf63278a337644700c11a8262cb6238c9765af55044bb90a2affe0675cdf0.
  3. Encrypting the hash with the private key via RSA gives the value used in the signature: BIp4wikYQLfkUusg30p95diNK1xoJsBY1+WVP2+/FXB6BfQE54Pui1iffu2ByYwfqAf9AxMGYza4trQSTGTYNLpcsbUtHBt77fellBRK0ATxeIxMrJAyXQJ482Kl3odvR49VuM/ebyx+oHiUuBVYMuHK9MgvdkmAu2kZQvCpXQooyfWBADqQKIBn0yxIDsDtbbRbyxjf5AxP1qguxsTPLr5N8cFv5Uo056qs83h1iXjf2SsYNTVA02RPF9deCljsdgMSdxrkLVletsq/UFUx33d+/fvcj1dg2WTKdiUzhOTfD2s5h8HoG2mCIWp5+8gKl+SXBjIzs2Yy7vAJurtoww==.
  4. DoorDash will use the public key to decrypt the signature and compare the hash to guarantee authenticity and integrity of the URL.