API

Manage your firm's data-plane API key, and how to integrate directly

API key

Status
Loading…

Integrating directly

Every firm gets the same onboarding: a firm slug, a dashboard password, and an API key. Use the dashboard day-to-day, plug directly into your own backend, or both — nothing here is exclusive.

Credentials

CredentialUsed asPurpose
Firm slugX-Client-Id headerIdentifies which firm a request belongs to
API keyX-Api-Key headerAuthenticates the request — shown once when generated above, never recoverable after, only re-rotatable

The API server uses a self-signed certificate, so pass -k (curl) / disable cert verification in your HTTP client. Base URL: https://18.185.59.156.

Submit a verification directly

POST /api/v1/verify — authenticate with X-Client-Id + X-Api-Key.

curl -k -X POST https://18.185.59.156/api/v1/verify \ -H "X-Client-Id: your-firm-slug" \ -H "X-Api-Key: YOUR_API_KEY" \ -F "country=NG" \ -F "doc_type=passport" \ -F "mode=3" \ -F "user_ref=your_internal_applicant_id" \ -F "id_image=@id_front.jpg" \ -F "liveness_frames=@frame1.jpg" \ -F "liveness_frames=@frame2.jpg"

mode: 1 = ID + selfie (-F selfie=@...), 2 = ID + holding photo (-F holding_photo=@...), 3 = ID + 1–5 liveness frames. Optional -F id_image_back=@.... Every submission is auto-tagged to your firm and shows up filtered to your data in the dashboard.

Generate a hosted capture link programmatically

To hand off to the hosted capture page instead of building your own camera/liveness UI: link generation needs a dashboard session, so sign in first with your firm slug and password to get a cookie, then create the link with that cookie. The X-Api-Key is not accepted on this endpoint.

POST /api/v1/admin/login → POST /api/v1/admin/sessions

curl -k -c cookies.txt -X POST https://18.185.59.156/api/v1/admin/login \ --data-urlencode "firm=your-firm-slug" \ --data-urlencode "password=YOUR_DASHBOARD_PASSWORD" curl -k -b cookies.txt -X POST https://18.185.59.156/api/v1/admin/sessions \ -H "Content-Type: application/json" \ -d '{"user_ref": "your_internal_applicant_id"}'

Redirect your user to the returned url. It's single-use and expires in 24 hours — only that disposable token touches the customer's browser, never your key or password. (Or just use the Generate Link page.)