Documentation
Build on KYCVerify.
Create sessions on https://kycverify.me/api, send people to the hosted flow and receive signed decisions. Every path, field and limit here is taken from the code.
Start here
Three pages to a working integration.
- 01QuickstartCreate a session, send the link, verify the signed webhook and read the decision.About 10 minutes
- 02ConceptsOrganisations, apps, workflows, sessions, checks and decisions, and how they fit together.About 5 minutes
- 03AuthenticationAPI keys, how they are scoped and stored, and the three kinds of credential in KYCVerify.About 4 minutes
The integration
Two calls, one link, one signed event.
Everything else in these docs is detail on one of these eight steps.
Your backend
KYCVerify API
Hosted flow
Your webhook
- 1POST /v1/sessionsYour backend to KYCVerify API: x-api-key; returns url, session_id
- 2Send the urlYour backend to Hosted flow: redirect, email or QR code
- 3Consent, document, livenessHosted flow to KYCVerify API: /flow/{token}/… per enabled step
- 4POST /flow/{token}/submitHosted flow to KYCVerify API: status becomes processing
- 5Background checksKYCVerify API to KYCVerify API: face match, AML, age, duplicate, IP
- 6session.status_updatedKYCVerify API to Your webhook: HMAC-SHA256 signed, decision included
- 7Return to callback_urlKYCVerify API to Hosted flow: ?session_id=…&status=…
- 8GET /v1/sessions/{id}/decisionYour backend to KYCVerify API: any time, optional
- 1Your backend → KYCVerify APIPOST /v1/sessionsx-api-key; returns url, session_id
- 2Your backend → Hosted flowSend the urlredirect, email or QR code
- 3Hosted flow → KYCVerify APIConsent, document, liveness/flow/{token}/… per enabled step
- 4Hosted flow → KYCVerify APIPOST /flow/{token}/submitstatus becomes processing
- 5KYCVerify APIBackground checksface match, AML, age, duplicate, IP
- 6KYCVerify API → Your webhooksession.status_updatedHMAC-SHA256 signed, decision included
- 7KYCVerify API → Hosted flowReturn to callback_url?session_id=…&status=…
- 8Your backend → KYCVerify APIGET /v1/sessions/{id}/decisionany time, optional
Get started
API
- API referenceEvery public endpoint: parameters, example requests and responses, and the errors worth handling.
- SessionsThe life of a session: creating it, following it, deciding it and erasing it.
- Hosted flowThe verification UI the person completes: how to send them there, embed it, brand it and get them back.
- WebhooksSigned session events with persisted retries, in five languages.
- ChecksThe ten check kinds, their statuses, warning codes and decision reasons.
- WorkflowsThe configuration a session runs: steps, thresholds, countries and the decision mode.
- Errors and limitsOne error envelope, eight codes, and every limit the API enforces.
Reference
Every public endpoint.
Authenticated with x-api-key, JSON in and out, one error envelope.
- POST
/v1/sessionsCreate a session - GET
/v1/sessionsList sessions - GET
/v1/sessions/{id}Get a session - GET
/v1/sessions/{id}/decisionGet the decision - PATCH
/v1/sessions/{id}/statusDecide a session in review - DELETE
/v1/sessions/{id}Purge a session - GET
/v1/workflowsList workflows - POST
/v1/checks/amlScreen a name - POST
/v1/checks/panValidate a PAN - POST
/v1/checks/mrzParse an MRZ - POST
/v1/checks/face-matchCompare two faces - POST
/v1/checks/aadhaar/secure-qrVerify an Aadhaar Secure QR
MRZ check digits, explained
How the 7-3-1 algorithm in ICAO Doc 9303 works, worked through on the specimen passport, and what it can and cannot prove.
DocumentsAadhaar Secure QR and Offline e-KYC, explained
What the two UIDAI-signed offline artefacts contain, how their signatures are verified, and how to handle them without storing Aadhaar numbers.
IndiaActive versus passive liveness
What challenge-response liveness checks, what passive and certified PAD add, and how to choose honestly for your risk.
BiometricsFace match: embeddings, similarity and thresholds
How a selfie is compared with a document portrait, what the similarity score means, and how to set the pass and review thresholds.
BiometricsSanctions screening: lists, fuzzy names and false positives
Where the OFAC and UN lists come from, how names are normalised and scored, why a hit never declines a session on its own, and what screening does not cover.
RiskVerifying webhook signatures
Why KYCVerify signs a timestamp with the body, how to verify it correctly in Node.js, Python, Go, Rust and PHP, and the mistakes that break it.
Developers
Get a test key and try the loop.
Sign up, create a kyc_test_ key and run the quickstart against the sandbox app.