Developer guide

$base = 'https://www.kyc.af/api/v1';
$key = 'kyc_live_YOUR_KEY';

$ch = curl_init($base.'/verifications');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer '.$key,
        'Content-Type: application/json',
        'Accept: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'customer_name' => 'Ahmad Khan',
        'email' => 'customer@example.com',
        'reference_id' => 'ORDER-125',
        'return_url' => 'https://your-app.example/clientarea.php',
    ]),
]);

$response = curl_exec($ch);
curl_close($ch);
$verification = json_decode($response, true);
echo $verification['verification_url'];

// Webhook receiver
$secret = 'YOUR_WEBHOOK_SECRET';
$body = file_get_contents('php://input');
$timestamp = $_SERVER['HTTP_X_WEBHOOK_TIMESTAMP'] ?? '';
$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
$expected = 'sha256='.hash_hmac('sha256', $timestamp.'.'.$body, $secret);

if (! hash_equals($expected, $signature)) {
    http_response_code(401);
    exit('Invalid webhook signature.');
}

$event = json_decode($body, true);
if (($event['data']['status'] ?? '') === 'verified') {
    // Mark the customer verified in your system.
}

import hashlib
import hmac
import json
import os

import requests

BASE = "https://www.kyc.af/api/v1"
KEY = "kyc_live_YOUR_KEY"

response = requests.post(
    f"{BASE}/verifications",
    headers={"Authorization": f"Bearer {KEY}", "Accept": "application/json"},
    json={
        "customer_name": "Ahmad Khan",
        "email": "customer@example.com",
        "reference_id": "ORDER-125",
        "return_url": "https://your-app.example/clientarea.php",
    },
    timeout=15,
)
response.raise_for_status()
verification = response.json()
print(verification["verification_url"])

# Webhook receiver (Flask)
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["KYC_WEBHOOK_SECRET"]

@app.post("/webhooks/kyc")
def kyc_webhook():
    body = request.get_data()
    timestamp = request.headers.get("X-Webhook-Timestamp", "")
    signature = request.headers.get("X-Webhook-Signature", "")
    expected = "sha256=" + hmac.new(
        SECRET.encode(), f"{timestamp}.".encode() + body, hashlib.sha256
    ).hexdigest()
    if not hmac.compare_digest(expected, signature):
        abort(401)
    event = json.loads(body)
    if event.get("data", {}).get("status") == "verified":
        pass
    return {"ok": True}

import crypto from "node:crypto";

const BASE = "https://www.kyc.af/api/v1";
const KEY = "kyc_live_YOUR_KEY";

const created = await fetch(`${BASE}/verifications`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${KEY}`,
    "Content-Type": "application/json",
    Accept: "application/json",
  },
  body: JSON.stringify({
    customer_name: "Ahmad Khan",
    email: "customer@example.com",
    reference_id: "ORDER-125",
    return_url: "https://your-app.example/clientarea.php",
  }),
}).then((response) => response.json());

console.log(created.verification_url);

// Webhook receiver (Express)
import express from "express";

const app = express();
app.use(express.raw({ type: "application/json" }));

app.post("/webhooks/kyc", (req, res) => {
  const timestamp = req.get("X-Webhook-Timestamp") ?? "";
  const signature = req.get("X-Webhook-Signature") ?? "";
  const expected =
    "sha256=" +
    crypto
      .createHmac("sha256", process.env.KYC_WEBHOOK_SECRET)
      .update(`${timestamp}.`)
      .update(req.body)
      .digest("hex");

  const valid =
    expected.length === signature.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));

  if (!valid) {
    return res.status(401).send("Invalid webhook signature.");
  }

  const event = JSON.parse(req.body.toString("utf8"));
  if (event.data?.status === "verified") {
    // Mark the customer verified in your system.
  }

  res.json({ ok: true });
});

curl -X POST "https://www.kyc.af/api/v1/verifications" \
  -H "Authorization: Bearer kyc_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
    "customer_name": "Ahmad Khan",
    "email": "customer@example.com",
    "reference_id": "ORDER-125",
    "return_url": "https://your-app.example/clientarea.php"
  }'

curl "https://www.kyc.af/api/v1/verifications/ver_01xyz" \
  -H "Authorization: Bearer kyc_live_YOUR_KEY" \
  -H "Accept: application/json"