Deeplink format
Anatomy of a deeplink
https://www.doordash.com/rx/{merchant_tag}?store_id=...&item=...&signature=...
IMPORTANT NOTE
Merchants should not, under any circumstances, provide DoorDash with any identifying patient data or Protected Health Information related to the prescription order within the deeplink.
Path parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
merchant_tag | string | Yes | The unique pharmacy identifier for the merchant. |
Query parameters
| Parameter | Type | Required | Repeatable | Description |
|---|---|---|---|---|
store_id | string | Yes | No | The unique identifier for the merchant's store. |
item | string | Yes | Yes | Encodes the prescription details in the format: <prefix>:<copay>:<expiry>. |
signature | string | Yes | No | The signature of the URL; see signature Details. |
item parameter format
<3-letter prefix>:<copay in cents>:<expiration in unix time (seconds)>
| Component | Description |
|---|---|
prefix | The first 3 letters of the prescription name. |
copay | Cost in cents. Example: 500 = $5.00. |
expiration | Unix timestamp for expiration (in seconds). Example: 1749225600. |
signature details
- The merchant will generate a RSA key pair and provide DoorDash with the public key.
- The merchant will hash (SHA-256) the url path beginning with the
<merchant_tag>up to the end of the last non-signatureparameter. - The merchant will sign the URL by encrypting the hash with their private key.
- The resulting string is to be used as the value of the
signatureparameter.
Example
The following deeplink will be used as an example.
https://www.doordash.com/rx/abc?store_id=123&item=PRO:500:1749225600
&signature=BIp4wikYQLfkUusg30p95diNK1xoJsBY1+WVP2+/FXB6BfQE54Pui1iff
u2ByYwfqAf9AxMGYza4trQSTGTYNLpcsbUtHBt77fellBRK0ATxeIxMrJAyXQJ482Kl3
odvR49VuM/ebyx+oHiUuBVYMuHK9MgvdkmAu2kZQvCpXQooyfWBADqQKIBn0yxIDsDtb
bRbyxjf5AxP1qguxsTPLr5N8cFv5Uo056qs83h1iXjf2SsYNTVA02RPF9deCljsdgMSd
xrkLVletsq/UFUx33d+/fvcj1dg2WTKdiUzhOTfD2s5h8HoG2mCIWp5+8gKl+SXBjIzs
2Yy7vAJurtoww==
The deeplink contains the following information:
| Parameter | Value | Explanation |
|---|---|---|
merchant_tag | abc | |
store_id | 123 | |
item | PRO:500:1749225600 | This item corresponds to a prescription beginning with PRO, has a $5.00 copay, and expires at Unix timestamp 1749225600 (which is June 6, 2025, 12:00 PM ET) |
signature | BIp4wikYQLfkUusg30p95diNK1xoJsBY1+WVP2+/FXB6BfQE54Pui1iffu2ByYwfqAf9AxMGYza4trQSTGTYNLpcsbUtHBt77fellBRK0ATxeIxMrJAyXQJ482Kl3odvR49VuM/ebyx+oHiUuBVYMuHK9MgvdkmAu2kZQvCpXQooyfWBADqQKIBn0yxIDsDtbbRbyxjf5AxP1qguxsTPLr5N8cFv5Uo056qs83h1iXjf2SsYNTVA02RPF9deCljsdgMSdxrkLVletsq/UFUx33d+/fvcj1dg2WTKdiUzhOTfD2s5h8HoG2mCIWp5+8gKl+SXBjIzs2Yy7vAJurtoww== | See How the signature was generated for an explanation. |
How the signature was generated
For the purposes of this example, we will use the following key pair.
Public Key
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApPukzemmUu6vGhxQxRMo
MOdxM0+4JYM5mIXl+Ob7aXnm390bZ9AdFMbf4T5Rsr8siC7Gxvt20Pq3tt6fO/Eh
8RPneg/l1QaHptpRwNoh9WCB4gGf47pc4CwDwa/74UzVEy75I8cNWENvPqF3jkBH
N1BT+6ylpUvgwNALVCaP0w79pMf/VEYZDMFaV+k8klwIcRgV9R4cXMpmhI8j7y2W
hZmxJfM888Pn8uPT+pPeeJxvyJ3VshVBhJlPMPXEWV1/RNVh+d3gL6FY70nOpuYR
qe9eLxj+bJMvrumCdY4G/h1bZpxcSEjp8y1nYHa1v5unM4KUbMuT+J8kgMcpcveU
2QIDAQAB
-----END PUBLIC KEY-----
Private Key
-----BEGIN RSA PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCk+6TN6aZS7q8a
HFDFEygw53EzT7glgzmYheX45vtpeebf3Rtn0B0Uxt/hPlGyvyyILsbG+3bQ+re2
3p878SHxE+d6D+XVBoem2lHA2iH1YIHiAZ/julzgLAPBr/vhTNUTLvkjxw1YQ28+
oXeOQEc3UFP7rKWlS+DA0AtUJo/TDv2kx/9URhkMwVpX6TySXAhxGBX1HhxcymaE
jyPvLZaFmbEl8zzzw+fy49P6k954nG/IndWyFUGEmU8w9cRZXX9E1WH53eAvoVjv
Sc6m5hGp714vGP5sky+u6YJ1jgb+HVtmnFxISOnzLWdgdrW/m6czgpRsy5P4nySA
xyly95TZAgMBAAECggEARjhtHs9R4X6BvMVMg3Tx6E652bMWl7DQtOBYz6XQYEZo
Q+QiI/9qQUucQox5zXCdDaGLLWoeWjg8NXNvpt2tKqTkIwndMtxCpHvLzB+L0Jqw
7XbvjMfne+p/9tJmjLBdCHs3w0iXn3ekQ64J6tvk8+AWvsnu/vnawXZLPBflo1jQ
7/SxNKY4rARXcb7N94l26fN092U+1xK+G9AGhbpCi4RfVflntretgSdQYSHE4onW
gtt7lgSpdxO9V3XUn1bmsRBotjmFeRQJNNTfA86ZKTUZea5WQzXw3goj7LMZgxzq
6NwDLRFi82ZF+zc7n07qhycdCjr3G98zWJShLK1hmQKBgQDXHMxthF9UrZC+6U0m
clrxIQZ4Kcf1C2UV1Flj3L/oiXRr6U6DJAf8v2OIR61/ZK1AiWq+/B9vhHyCKF5t
dX7xNoyUi3TFe9cPCelAuKPytUGdQQqYN2UPCjEZsNJPlHx1g7K9N5T51KuzzyR7
p/FmZTMhO6hSFZmLoT8XGoUQGwKBgQDEV5VbboOU8JcpoQd3jSGTXNKAtjniaNuH
uwBoMIYW7HY6OHhT1C59aTzYON+GVjoHBjTrj/HADSucFmuUcVZXNfVOhIIR9bCb
a/5WTubnsKbmn9P+Vv0U6iYZqxA0GPjIUXUe3NNvcSYdWnb3YnnVaLMBvpU2aDkE
axYbQQ7GGwKBgQCM21y5ce6Cokyf1mEghc0rC/cShDldKiL9ElmeXJSFjkxfxRwW
H2fjhueD+3uOabxRACqX+LwU5+onyItcnY2MIa4YLuE914PRYyoLqVwht7LJaCep
2Mwh9wiDzBdK6O4+fQhzgovYs/vi+AbpueUGqcm7PzdO2Ln8ho+rb0AmdQKBgBIg
C7evEhKTy0CajvfoXWsfLIeZSuqtx2ZWSwlTQW2oUpm5UNJcShZluqozRd8+4oh3
eDcuyKB0FsyH/VJszA2s+4JOFTvXNICEjawmCIbm9eFga8+U9DQUEYRZGFvW2lCT
xH4e4J3vEhevnD/mJV0gFzZYA6pMIMdZo2bMsLJ1AoGAJxaNFb5dc/Av0og1EO0j
1L03yRzR4Mgz0QCj2FLR5+gtX4lWfPFemic41mWqVXgooxvgceCNzK99AhmNUzky
tOzvayOxJ3gAMNskX47vv5dNlsfHyR3T1L5lkLL79sbWjipquZaCzKRCYz4ehwk3
L9fW+XR72QABmt2ALa1BoeI=
-----END RSA PRIVATE KEY-----
Process
- The string to be hashed is
abc?store_id=123&item=PRO:500:1749225600. - The SHA-256 hash of this string is
a9bcf63278a337644700c11a8262cb6238c9765af55044bb90a2affe0675cdf0. - Encrypting the hash with the private key via RSA gives the value used in the signature:
BIp4wikYQLfkUusg30p95diNK1xoJsBY1+WVP2+/FXB6BfQE54Pui1iffu2ByYwfqAf9AxMGYza4trQSTGTYNLpcsbUtHBt77fellBRK0ATxeIxMrJAyXQJ482Kl3odvR49VuM/ebyx+oHiUuBVYMuHK9MgvdkmAu2kZQvCpXQooyfWBADqQKIBn0yxIDsDtbbRbyxjf5AxP1qguxsTPLr5N8cFv5Uo056qs83h1iXjf2SsYNTVA02RPF9deCljsdgMSdxrkLVletsq/UFUx33d+/fvcj1dg2WTKdiUzhOTfD2s5h8HoG2mCIWp5+8gKl+SXBjIzs2Yy7vAJurtoww==. - DoorDash will use the public key to decrypt the signature and compare the hash to guarantee authenticity and integrity of the URL.