Skip to main content
ShieldID

Developers

Identity verification API documentation, built to actually use.

One REST API, a hosted page for the parts you don't want to build, and signed webhooks so you find out the moment a result is in. Sandbox keys are never billed, so the fastest way to understand ShieldID is to call it.

Start free in sandboxRead the quickstart

The five-minute version

Four calls. One mental model.

Everything else in these docs is detail on top of this loop.

  1. Create a session

    POST /v1/sessions with a return URL and a webhook URL. You get back a session_id and a verification_url.

  2. Hand it to the applicant

    Send the verification_url as a link, or let them scan the QR code the hosted page shows on desktop. They finish on their own phone.

  3. Receive a signed webhook

    When the session reaches VERIFIED or FAILED, ShieldID POSTs the result to your webhook URL, signed so you can trust it came from us.

  4. Read the result

    Trust the webhook, or call GET /v1/sessions/{id}/result yourself. Either way you get per-check verdicts, not one opaque score.

Try it

Create your first session.

The same request in three languages. This is the call step one of the mental model is describing.

bash
# Create a verification session (sandbox keys are never billed)
curl -X POST https://api.shieldid.ca/v1/sessions \
  -H "X-Api-Key: vk_sand_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "return_url": "https://yourapp.example/verified",
    "webhook_url": "https://yourapp.example/hooks/shieldid"
  }'

# → { "session_id": "…", "verification_url": "https://…/v/…", "environment": "sandbox" }

Sandbox keys (vk_sand_…) run this exact flow for free. Swap in a vk_live_ key and nothing else changes except the invoice.

Find your way in

The rest of the developer docs.

Six pages. Read the ones you need.

SDKs

The web widget, the hosted flow, and what's coming.
Open SDKs

Status

What we'll report on, once the feed is live.
Open Status

Sandbox

Test the whole flow before you sign anything.

A sandbox key (prefix vk_sand_) runs the identical API, hosted page and webhook flow as production. Sessions are stamped environment: "sandbox" everywhere they appear, and sandbox sessions are never billed, on any plan.

Read the sandbox guide
  • Create real sessions, verify a real document on your own phone, get a real signed webhook back
  • Nothing you do in sandbox touches an invoice
  • Switch to production by swapping the key prefix; the request shape doesn't change

Built in the open

What's finished, and what isn't yet.

We would rather tell you than have you find out mid-integration.

Web widget completion callbacks

Coming soon

onComplete, onCancel and onStep exist in the widget's interface today, but nothing fires them yet. Use the return URL and the webhook — both work now.

Enforced rate limits

Coming soon

Every API key has a rate limit recorded against your plan, but it isn't enforced on requests yet — plan accordingly, don't rely on ShieldID to throttle you.

Self-serve sandbox signup

Coming soon

Sandbox keys are issued on request while self-serve signup is being built. Ask and we'll turn one around fast.

Questions

Straight answers for developers.

Get started

Go live in an afternoon.

Start with a sandbox key, run a verification on your own phone, and read the webhook it sends you. No sales call required.

Start free in sandboxRead the quickstart

Sandbox sessions are never billed.