> For the complete documentation index, see [llms.txt](https://finext.gitbook.io/one-kyc/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://finext.gitbook.io/one-kyc/introduction/quick-start.md).

# Quick start

This guide describes the minimum steps to launch user verification through OneKYC. After four steps, you have a fully working integration: from creating a verification scenario to receiving results.

***

## Step 1. Get access to the platform

1. Obtain credentials for the OneKYC admin panel (provided by your account manager or during sign-up).
2. Sign in to the admin panel.
3. Open the **API keys** section and create a KYC-type API key:
   * **Environment:** select `test` for development or `live` for production.
   * **Scopes:** select the required permissions (for the quick start, `*` is recommended for full access).
4. **Save the key secret** — it is shown once. The secret is required to compute the HMAC signature when calling the API.

> **Important.** The key secret (with the `sk_` prefix) must stay on the server side. Never expose it to the client.

***

## Step 2. Create a verification flow

Open the **Flows** section in the admin panel:

* **From a template (recommended):** open the **Template gallery** and choose a ready-made scenario, for example "Standard KYC" (document + selfie + liveness) or "Basic KYC" (document only).
* **From scratch:** click "Create flow" and add the steps you need in the visual editor: document upload, selfie, liveness check, OTP, AML screening, manual review, etc.

After configuration, **publish** the flow. Copy the **flow identifier** (`flow_id`) — you need it for the next step.

***

## Step 3. Create a verification link

You can create a verification link in two ways:

### Option A. Via the Tenant API (recommended for integration)

Send a request from the server side, signed with HMAC:

<mark style="color:green;">`POST`</mark> `undefined/v1/kyc/verification-links`

**Key request parameters:**

| Parameter          |     Required     | Description                                                                             |
| ------------------ | :--------------: | --------------------------------------------------------------------------------------- |
| `flow_id`          |        Yes       | Identifier of the published verification flow                                           |
| `external_user_id` | No (recommended) | User identifier in your system. Lets you link the verification result back to your user |
| `redirect_url`     |        No        | URL to redirect to after verification completes                                         |
| `locale`           |        No        | UI language (`en`, `ru`)                                                                |
| `expires_in`       |        No        | Link lifetime in seconds (defaults to the flow configuration)                           |

**Computing the HMAC signature:** the algorithm is described, with JavaScript and Go examples, in the [Authentication](/one-kyc/api/authentication.md) section.

The response returns the verification link URL. Deliver it to the user by email, SMS, messenger, or in your application's customer portal.

### Option B. Via the admin panel (for testing)

Open the **Verification links** section and click "Create link":

1. Choose the published flow.
2. Optionally set `external_user_id`, `redirect_url`, and the lifetime.
3. Copy the generated link and open it in your browser to run a test verification.

***

## Step 4. Register a webhook to receive results

To receive verification results in real time, configure a webhook:

1. Open the **Webhooks** section of the admin panel.
2. Click "Create endpoint".
3. Enter the URL of your server where OneKYC sends notifications.
4. Select event types — to start, subscribe to:
   * `verification.approved` — verification approved
   * `verification.declined` — verification declined
   * `verification.needs_review` — verification routed to manual review
5. Save the **webhook secret** (with the `whsec_` prefix) — you need it to verify the authenticity of incoming notifications.

> **Signature verification:** every webhook carries an `X-Onekyc-Signature` header with an HMAC-SHA256 signature. For details, see [Webhooks](/one-kyc/api/webhooks.md).

**Alternative — query via the API:**

<mark style="color:blue;">`GET`</mark> `undefined/v1/kyc/applicants`

***

## Done

The integration is complete. When the user opens the verification link, they go through the flow on the OneKYC page, and your server receives the result through the webhook.

### Next steps

* [**Authentication**](/one-kyc/api/authentication.md) — HMAC signature details, key types, scopes
* [**Webhooks**](/one-kyc/api/webhooks.md) — full event list, payload format, signature verification, retry policy
* [**Applicants**](/one-kyc/api/applicants.md) — fetching verification data, documents, AML results
* [**Verification links**](/one-kyc/api/verification-links.md) — link lifecycle, batch creation, QR codes
* [**Flows**](/one-kyc/api/flows.md) — configure verification scenarios via the API
* [**KYB API**](/one-kyc/kyb.md) — business (legal entity) verification
* [**Errors and limits**](/one-kyc/api/errors-and-limits.md) — error codes, rate limits
* [**API reference (OpenAPI)**](/one-kyc/api/api-reference.md) — interactive reference for all endpoints