Skip to Content
KnowaKYC
Introduction

KnowaKYC documentation

This documentation is for developers integrating with the KnowaKYC platform and for users of the admin panel. It covers the product, the integration guide, and the API reference. For a detailed overview of platform capabilities, see Product overview.

Documentation contents:

Note. The KnowaKYC Tenant API is in beta. Endpoints, data formats, and API versions may change. Track documentation updates.

Frequently asked questions

Where does verification run — on the client side or the KnowaKYC side?

Verification runs on the KnowaKYC side. Integration is reduced to creating a verification link via the API and delivering it to the end user (by email, SMS, QR code, etc.). The user opens the link, lands on the KnowaKYC verification page, and completes every check defined by the flow. Results are returned to the client through webhooks or API requests.

Can the verification UI be embedded into our own interface?

Yes. You can redirect the user to the KnowaKYC verification page, open it in a new browser window, or embed it in an iframe. The KnowaKYC UI is responsive and works on both desktop and mobile devices.

To embed the verification page, delegate camera access to the frame. Without the allow attribute, browsers block the camera inside the iframe. Use the url field from the create-verification-link response as src:

<iframe
  src="<verification link url>"
  title="Identity verification"
  allow="camera; microphone; fullscreen; clipboard-write"
  style="width: 100%; height: 100%; min-height: 680px; border: 0"
></iframe>
  • If your page sends a Permissions-Policy header, it must allow the camera for the verification domain, for example camera=(self "https://<verification domain>").
  • If your page sets a Content Security Policy, add the verification domain to frame-src.
  • Recommended frame size: at least 600×680 px on desktop. On mobile devices, show the frame full screen or redirect to the verification page.
  • When the flow completes, the completion redirect replaces the whole page, not only the frame.
  • If camera access is unavailable inside the frame, the user can continue in a new tab or on a phone via QR code.
  • In-app browsers (Instagram, Facebook, TikTok) and native WebViews may restrict the camera; for native apps, open the link in the system browser or grant camera permission to the WebView.

How does the cross-device flow work?

A user can start verification on a desktop computer (for filling out forms) and continue on a mobile device (for capturing documents and selfies). When you create a link, a QR code is generated; after scanning it, the user continues the same session on the mobile device.

The QR code is valid for 5 minutes and is single-use: once scanned, the token is invalidated. If the QR code expires, refresh the page to generate a new one.

Which document types are supported?

KnowaKYC supports passports, ID cards, and driver's licences from most countries. The current list is available through the Tenant API: GET /tenant/v1/kyc/documents/supported. The flow configuration determines which document types are accepted for a given verification scenario.

Can the verification flow be customised?

Yes. Flows are configured through the Flow Editor in the admin panel. You can add and remove steps (document upload, selfie, liveness check, OTP confirmation, AML screening, manual review), reorder them, and adjust their parameters. Changes take effect for new sessions after you publish the updated flow version.

How do I receive verification results?

Two options are available:

  1. Webhooks (recommended) — KnowaKYC sends event notifications to your URL in real time (for example, verification.approved, verification.declined).
  2. API polling — query the verification status periodically through the /tenant/v1/kyc/applicants/{applicant_id}/verification endpoint.

How long does verification take?

  • Automatic verification (no manual review) — 30–60 seconds (document upload, selfie, automated checks).
  • With manual review — depends on reviewer queue load (from a few minutes to several hours).
  • With AML screening — adds 5–15 seconds.

What should I do if a user fails verification?

The recommended action depends on the rejection reason (the rejection_reason field in the API response):

  • Low image quality — ask the user to retry by issuing a new verification link.
  • Expired document — notify the user and request a valid document.
  • Face mismatch — possible fraud signal; consider manual review or rejection.
  • AML hit — the decision rests with you, in line with your internal risk-management procedures.

How do I test the integration?

  1. Create an API key with the kyc_test_ prefix in the admin panel.
  2. Use test keys in your development and staging environments.
  3. For webhook testing, use ngrok or a similar tool for local development.
  4. Sessions created with test keys are not billed.

Can user data be deleted (GDPR)?

Yes. Use the DELETE /tenant/v1/kyc/applicants/{applicant_id} endpoint to create a deletion request. The request is reviewed before execution; once approved and executed, the deletion is irreversible.

How is billing calculated?

Billing is based on the number of successfully completed verifications. Test keys (kyc_test_*) are not billed. Pricing details are available in the admin panel or from your account manager.


To get started, head to Product overview or Quick start.

On this page