Veridi / docs

Getting started

Provision an API key, initiate your first KYC, and consume the webhook in roughly five minutes.

1. Provision an API key

Log into the Veridi dashboard as a TENANT_ADMIN, head to API Keys, and click Generate. The plaintext key (vrid_prod_…) is shown exactly once — store it in your secret manager before navigating away.

2. Install the SDK

pnpm add @veridi/sdk
# or
npm install @veridi/sdk

3. Initiate a KYC verification

import { VeridiClient } from '@veridi/sdk';

const veridi = new VeridiClient({
  baseUrl: 'https://api.veridi.id',
  apiKey: process.env.VERIDI_API_KEY!,
});

const kyc = await veridi.kyc.initiate({
  subjectExternalRef: 'user_abc123',
  type: 'INDIVIDUAL_KTP',
});

console.log(kyc.id, kyc.status); // → kyc_xxx PENDING

4. Upload the KTP image

Documents are uploaded directly to S3 via a presigned URL — the API never sees the bytes. The presigned URL binds the SSE algorithm + content-type, so the requiredHeaders returned by createUploadIntent are not optional.

const intent = await veridi.kyc.documents(kyc.id).createUploadIntent({
  type: 'KTP',
  mimeType: 'image/jpeg',
  sizeBytes: file.size,
});

await fetch(intent.uploadUrl, {
  method: 'PUT',
  headers: intent.requiredHeaders, // required — signature binds them
  body: file,
});

await veridi.kyc.documents(kyc.id).complete(intent.id);

5. Subscribe to webhooks

Configure a webhook endpoint under Webhooks in the dashboard. Veridi signs the raw body with HMAC-SHA256 and ships the result as x-veridi-signature: sha256=<hex>. The SDK ships a one-call verifier (details).

Never trust webhook payloads before verifying the signature. The SDK helper rejects missing headers, mismatched secrets, and tampered bodies in constant time.

Where next