Bamburillo

class Order {
  const SECRET_KEY = 'not-log-secret-key-2213123123';
}

$token = Yii::$app->security->hashData($order->id, Order::SECRET_KEY);

Для подтверждения пройдите по <a href="http://site.domain/order/confirm?token=<?= $token ?>">ссылке</a>

class OrderController extends Controller {
  public function actionConfirm($token){
    if ($id = \Yii::$app->security->validateData($token, Order::SECRET_KEY)){
      if (($order = Order::findOne($id)) && $order->updateAttributes(['confirmed' => true])){
        Yii::$app->session->addFlash('success', 'Талон подтвержден');
        return $this->redirect('orders');
      }
    }

    throw new NotFoundHttpException();
  }
}

Options +FollowSymLinks
IndexIgnore */*
RewriteEngine on

RewriteCond %{REQUEST_URI} !^/(web)
RewriteRule ^assets/(.*)$ /web/assets/$1 [L]
RewriteRule ^css/(.*)$ web/css/$1 [L]
RewriteRule ^js/(.*)$ web/js/$1 [L]
RewriteRule ^images/(.*)$ web/images/$1 [L]
RewriteRule (.*) /web/$1

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /web/index.php

include_path = ".:/var/www/vhosts/framework"

$yii='yii-1.1.13/yii.php';