---
title: "Generate KYC token"
method: POST
path: "/api/v2/token"
tags: ["KYC Token"]
---

# Generate KYC token

`POST /api/v2/token`

Creates a KYC verification session token. Pass the returned `authToken` to your frontend or SDK to launch the verification flow.

## Request body

- object
  - `clientId` string, required — A unique string identifying the client on your side.
  - `tokenType` 'IDENTIFICATION' | 'DOCUMENT', required — - `IDENTIFICATION` — document scan + selfie (default) - `DOCUMENT` — document scan only
  - `externalRef` string, nullable — Optional internal reference. Returned as-is in webhooks.
  - `generateDigitString` boolean — If `true`, generates an 8-digit mobile app code returned as `digitString`.
  - `expiryTime` integer — Token validity in seconds. Maximum 2,592,000 (30 days).
  - `locale` string, nullable — UI language code (e.g. `en`, `de`, `ko`).
  - `country` string, nullable — Restrict accepted document-issuing country (ISO alpha-2).
  - `sessionLength` integer — Seconds the user has to complete verification once started.
  - `documents` string[], nullable — Restrict accepted document types (e.g. `PASSPORT`, `ID_CARD`).
  - `firstName` string, nullable — Pre-fill client first name. Mismatch triggers `SUSPECTED` status.
  - `lastName` string, nullable — Pre-fill client last name. Mismatch triggers `SUSPECTED` status.
  - `dateOfBirth` string, date, nullable — Pre-fill client date of birth.
  - `nationality` string, nullable — Pre-fill client nationality.
  - `documentNumber` string, nullable — Pre-fill document number.
  - `personalNumber` string, nullable — Pre-fill personal/national ID number.
  - `sex` 'M' | 'F', nullable — Pre-fill client sex.
  - `dateOfExpiry` string, date, nullable — Pre-fill document expiry date.
  - `dateOfIssue` string, nullable — Pre-fill document issue date.
  - `address` string, nullable — Client address for Proof of Address verification.
  - `successUrl` string, uri, nullable — Redirect URL on successful verification.
  - `errorUrl` string, uri, nullable — Redirect URL on failed verification.
  - `unverifiedUrl` string, uri, nullable — Redirect URL when verification result is unverified.
  - `callbackUrl` string, uri, nullable — Override webhook callback URL for this session only.
  - `showInstructions` boolean
  - `reviewSuccessful` boolean — Enable manual review for successful verifications.
  - `reviewFailed` boolean — Enable manual review for failed verifications.
  - `questionnaire` string, nullable — Questionnaire `key` for this session. Pass `null` to disable.
  - `questionnaireRequired` boolean
  - `riskAssessmentProfile` string, uuid, nullable
  - `theme` string, uuid, nullable
  - `registryCentersCountries` string[], nullable
  - `verifyEmail` boolean
  - `verifyPhone` boolean
  - `verifyBank` boolean
  - `verifyBankAccounts` boolean
  - `verifyBankBalances` boolean
  - `verifyBankTransactions` boolean
  - `bankCardVerification` boolean
  - `bankCardPdfUpload` boolean
  - `verifyAddress` boolean
  - `checkAml` boolean
  - `checkCriminal` boolean
  - `checkLiveness` boolean
  - `checkFaceBlacklist` boolean
  - `checkDocFaceBlacklist` boolean
  - `checkPersonBlacklist` boolean
  - `checkDuplicateFaces` boolean
  - `checkDuplicateDocFaces` boolean
  - `checkDuplicatePersonalData` boolean
  - `checkDriverLicense` boolean
  - `checkLid` boolean
  - `checkIpProxy` boolean
  - `allowBsnMasking` boolean
  - `nfcRequired` boolean
  - `autoAmlMonitoring` boolean
  - `driverLicenseBack` boolean
  - `faceMatchingThresholdModifier` number
  - `additionalSteps` object — Request extra document steps. See Additional Steps documentation.
  - `additionalData` object — Data for COMPARE-type additional steps.
  - `utilityBill` boolean, nullable
  - `nfcOptional` boolean
  - `ageLimit` integer — Minimum required age. Below this triggers `SUSPECTED` status.
  - `ageMax` integer — Maximum allowed age. Above this triggers `SUSPECTED` status.

## Response `201`

Token created successfully.

- object
  - `message` string
  - `authToken` string, required — Pass this to the frontend, SDK, or redirect URL to start verification.
  - `redirectUrl` string, nullable — Direct URL to the hosted verification flow. Redirect the user here or embed in an iFrame.
  - `scanRef` string, required — Unique session ID. Store this to correlate with webhook results.
  - `clientId` string, nullable
  - `personScanRef` string, nullable
  - `firstName` string, nullable
  - `lastName` string, nullable
  - `successUrl` string, nullable
  - `errorUrl` string, nullable
  - `unverifiedUrl` string, nullable
  - `callbackUrl` string, nullable
  - `locale` string, nullable
  - `country` string, nullable
  - `expiryTime` integer — Token expiry time in seconds.
  - `sessionLength` integer
  - `documents` string[]
  - `allowedDocuments` object
  - `dateOfBirth` string, nullable
  - `dateOfExpiry` string, nullable
  - `dateOfIssue` string, nullable
  - `nationality` string, nullable
  - `personalNumber` string, nullable
  - `documentNumber` string, nullable
  - `sex` string, nullable
  - `address` string, nullable
  - `showInstructions` boolean
  - `tokenType` 'IDENTIFICATION' | 'DOCUMENT', required
  - `utilityBill` unknown
  - `additionalSteps` object
  - `additionalData` object
  - `externalRef` string, nullable
  - `questionnaire` string, nullable
  - `registryCentersCountries` string[]
  - `riskAssessmentProfile` string, uuid, nullable
  - `theme` string, uuid, nullable
  - `allowBsnMasking` boolean
  - `verifyBankTransactions` boolean
  - `bankCardVerification` boolean
  - `bankCardPdfUpload` boolean
  - `checkLid` boolean
  - `checkDriverLicense` boolean
  - `verifyAddress` boolean
  - `checkFaceBlacklist` boolean
  - `verifyEmail` boolean
  - `checkPersonBlacklist` boolean
  - `checkDuplicateDocFaces` boolean
  - `reviewSuccessful` boolean
  - `reviewFailed` boolean
  - `verifyBank` boolean
  - `autoAmlMonitoring` boolean
  - `verifyPhone` boolean
  - `faceMatchingThresholdModifier` number
  - `checkCriminal` boolean
  - `checkAml` boolean
  - `checkDuplicateFaces` boolean
  - `driverLicenseBack` boolean
  - `verifyBankAccounts` boolean
  - `checkDuplicatePersonalData` boolean
  - `verifyBankBalances` boolean
  - `nfcRequired` boolean
  - `checkIpProxy` boolean
  - `checkDocFaceBlacklist` boolean
  - `checkLiveness` boolean
  - `digitString` string, nullable — 8-digit mobile code. Only present when `generateDigitString` was `true`.

---

[API](https://skmtc.net/idenfy/apis/idenfy-ivs-core-api.md) · [All operations](https://skmtc.net/idenfy/apis/idenfy-ivs-core-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/idenfy/idenfy-ivs-core-api/revisions/3540d9ee5506/schema)