# Quick start

This guide describes the minimum steps to launch user verification through OneKYC. After four steps, you have a fully working integration: from creating a verification scenario to receiving results.

---

## Step 1. Get access to the platform [#step-1-get-access-to-the-platform]

1. Obtain credentials for the OneKYC admin panel (provided by your account manager or during sign-up).
2. Sign in to the admin panel.
3. Open the **API keys** section and create a KYC-type API key:
   - **Environment:** select `test` for development or `live` for production.
   - **Scopes:** select the required permissions (for the quick start, `*` is recommended for full access).
4. **Save the key secret** — it is shown once. The secret is required to compute the HMAC signature when calling the API.

> **Important.** The key secret (with the `sk_` prefix) must stay on the server side. Never expose it to the client.

---

## Step 2. Create a verification flow [#step-2-create-a-verification-flow]

Open the **Flows** section in the admin panel:

- **From a template (recommended):** open the **Template gallery** and choose a ready-made scenario, for example "Standard KYC" (document + selfie + liveness) or "Basic KYC" (document only).
- **From scratch:** click "Create flow" and add the steps you need in the visual editor: document upload, selfie, liveness check, OTP, AML screening, manual review, etc.

After configuration, **publish** the flow. Copy the **flow identifier** (`flow_id`) — you need it for the next step.

---

## Step 3. Create a verification link [#step-3-create-a-verification-link]

You can create a verification link in two ways:

### Option A. Via the Tenant API (recommended for integration) [#option-a-via-the-tenant-api-recommended-for-integration]

Send a request from the server side, signed with HMAC:

API operations:

- `POST /v1/kyc/verification-links`

**Key request parameters:**

| Parameter          |     Required     | Description                                                                                                  |
| ------------------ | :--------------: | ------------------------------------------------------------------------------------------------------------ |
| `flow_id`          |       Yes        | Identifier of the published verification flow                                                                |
| `external_user_id` | No (recommended) | User identifier in your system. Lets you link the verification result back to your user                      |
| `redirect_url`     |        No        | URL to redirect to after verification completes                                                              |
| `locale`           |        No        | UI language (`en`, `ru`)                                                                                     |
| `expires_in`       |        No        | Link lifetime in seconds (defaults to the flow configuration)                                                |

**Computing the HMAC signature:** the algorithm is described, with JavaScript and Go examples, in the [Authentication](/en/api/authentication) section.

The response returns the verification link URL. Deliver it to the user by email, SMS, messenger, or in your application's customer portal.

### Option B. Via the admin panel (for testing) [#option-b-via-the-admin-panel-for-testing]

Open the **Verification links** section and click "Create link":

1. Choose the published flow.
2. Optionally set `external_user_id`, `redirect_url`, and the lifetime.
3. Copy the generated link and open it in your browser to run a test verification.

---

## Step 4. Register a webhook to receive results [#step-4-register-a-webhook-to-receive-results]

To receive verification results in real time, configure a webhook:

1. Open the **Webhooks** section of the admin panel.
2. Click "Create endpoint".
3. Enter the URL of your server where OneKYC sends notifications.
4. Select event types — to start, subscribe to:
   - `verification.approved` — verification approved
   - `verification.declined` — verification declined
   - `verification.needs_review` — verification routed to manual review
5. Save the **webhook secret** (with the `whsec_` prefix) — you need it to verify the authenticity of incoming notifications.

> **Signature verification:** every webhook carries an `X-Onekyc-Signature` header with an HMAC-SHA256 signature. For details, see [Webhooks](/en/api/webhooks).

**Alternative — query via the API:**

API operations:

- `GET /v1/kyc/applicants`

---

## Done [#done]

The integration is complete. When the user opens the verification link, they go through the flow on the OneKYC page, and your server receives the result through the webhook.

### Next steps [#next-steps]

- **[Authentication](/en/api/authentication)** — HMAC signature details, key types, scopes
- **[Webhooks](/en/api/webhooks)** — full event list, payload format, signature verification, retry policy
- **[Applicants](/en/api/applicants)** — fetching verification data, documents, AML results
- **[Verification links](/en/api/verification-links)** — link lifecycle, batch creation, QR codes
- **[Flows](/en/api/flows)** — configure verification scenarios via the API
- **[KYB API](/en/kyb)** — business (legal entity) verification
- **[Errors and limits](/en/api/errors-and-limits)** — error codes, rate limits
- **[API reference (OpenAPI)](/en/api/api-reference)** — interactive reference for all endpoints