Verify a user or a business once. Share the result with a partner, they onboard the same person instantly. No second flow, no second selfie. Works for KYC and KYB. Built for Banking-as-a-Service, multi-brand groups, embedded finance, and marketplaces with sub-platforms.
Robinhood Ventures
Built for partner ecosystems
Your user verifies once in your app. Your partner, your BaaS sponsor, your sister brand, your downstream marketplace, needs the same record. Send them a one-time share token. They redeem it and pull in the full verification. The user never sees a second flow.
Choose any finished verification, approved, declined, or under review, and ask Didit for a share token. The token expires in one hour by default; you can stretch it from one minute up to a full day.
Hand the token to your partner over your own backend, a webhook, a queue, a REST call. The token only works for the partner you named when you minted it. Nobody else can redeem it.
Your partner redeems the token and picks how to onboard the user, trust your decision and approve instantly, or pull the data in raw and let their compliance team make the call.
Didit clones the whole record, documents, selfie, face match, AML, registry data, UBOs, into your partner's workspace. Same shape as a fresh verification, with a clean audit trail back to the original.
POST /v3/session/[id]/share/
POST /v3/session/import-shared/
Instant onboarding · or your own review
session_kind: user | business
user · KYC
business · KYB
Where one verification serves many
Finished-only · idempotent · audit-grade
$ curl -X POST https://verification.didit.me/v3/session/$SID/share/ \
-H "x-api-key: $DIDIT_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"for_application_id": "partner-app-uuid",
"ttl_in_seconds": 3600
}'$ curl -X POST https://verification.didit.me/v3/session/import-shared/ \
-H "x-api-key: $DIDIT_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"share_token": "eyJhbGciOi…",
"workflow_id": "wf_partner_kyc",
"vendor_data": "partner-user-42",
"trust_review": true
}'trust_review: false to land the session in In Review.docs →# Didit B2B Reusable KYC — partner-to-partner KYC sharing
You are integrating Didit's B2B Reusable Know Your Customer (KYC) into <my_stack>. The recipe is server-to-server: one Didit application (Service X) mints a short-lived JSON Web Token (JWT) share token for a finished session; a partner Didit application (Service Y) imports the token and Didit clones the full verified session into Service Y. Works for both KYC and Know Your Business (KYB) sessions.
Built for Banking-as-a-Service (BaaS) sponsor banks, multi-brand financial groups, embedded finance through partner banks, marketplaces with regional or vertical sub-platforms, on-ramp + exchange ecosystems, white-label resellers, and B2B KYB consortia where the same legal entity onboards once and serves many. Every URL, header, and enum value below is canonical — do not paraphrase or "improve" them.
## 1. Provision both applications
- Sign up: https://business.didit.me (no credit card required).
- Or provision programmatically: POST https://apx.didit.me/auth/v2/programmatic/register/
- Create TWO applications in your Didit organisation. One acts as Service X (mints share tokens), the other as Service Y (imports them). In production these will usually live in different organisations — one per partner.
- Each application has its own `x-api-key`. Service X uses its own key to mint; Service Y uses its own key to import.
## 2. Service X — mint a share token
Service X picks a finished session it owns and posts to the share endpoint:
POST https://verification.didit.me/v3/session/{sessionId}/share/
Headers:
x-api-key: <Service X api key>
Content-Type: application/json
Body:
{
"for_application_id": "<partner-application-uuid>",
"ttl_in_seconds": 3600
}
Bounds on `ttl_in_seconds`: min 60, max 86400, default 3600.
Requirements:
- The session must be in a FINISHED status: "Approved", "Declined", or "In Review".
- The API key must hold the `write:sessions` privilege.
- `for_application_id` must be a real Didit application uuid — usually the partner's app.
Response: 201 Created with the JWT in the `share_token` field plus `for_application_id` and `session_kind` ("user" or "business" — Didit detects this from the source session and embeds it in the token):
{
"share_token": "eyJhbGciOiJIUzI1NiJ9...",
"for_application_id": "partner-app-uuid",
"session_kind": "user"
}
## 3. Transmit the token to Service Y
Service X transmits the `share_token` to Service Y over a pre-arranged backend channel — REST, message queue, signed webhook, anything you control. The token is scoped to Service Y's application and useless to any other application.
## 4. Service Y — import the shared session
Service Y posts the token to the import endpoint:
POST https://verification.didit.me/v3/session/import-shared/
Headers:
x-api-key: <Service Y api key>
Content-Type: application/json
Body:
{
"share_token": "<jwt from step 2>",
"workflow_id": "<Service Y's own workflow id>",
"vendor_data": "<Service Y's internal user id>",
"trust_review": true
}
`trust_review`:
- `true` → the imported session preserves the original status ("Approved" / "Declined" / "In Review"). Service Y onboards the user instantly. Use when Service Y fully trusts Service X's decision (sister brand, regulated partner with a signed data-sharing agreement).
- `false` → the imported session lands in "In Review" so Service Y's compliance team makes its own call. Safe default for new partner relationships.
Response: 201 Created with a brand-new session in Service Y's application:
{
"session_id": "<new uuid>",
"session_number": <int>,
"session_kind": "user" | "business",
"status": "Approved" | "In Review" | "Declined",
"shared_from_session": "<original session uuid in Service X>",
"vendor_data": "<Service Y's internal user id>",
"id_verifications": [...],
"liveness_checks": [...],
"face_matches": [...],
"aml_screenings": [...],
"database_validations": [...],
"proof_of_address": [...],
"phone_verifications": [...],
"email_verifications": [...]
}
For a `session_kind: "business"` token Didit clones the KYB shape instead. KYB session statuses are UPPER_SNAKE_CASE (not Title Case like KYC):
{
"session_id": "<new uuid>",
"session_kind": "business",
"status": "APPROVED",
"shared_from_session": "<original business session uuid>",
"vendor_data": "<Service Y's internal business id>",
"registry_checks": [...],
"key_people_checks": [...],
"document_verifications": [...],
"aml_screenings": [...],
"questionnaires": [...]
}
A new User or Business entity is auto-created in Service Y if one with the supplied `vendor_data` doesn't already exist.
## 5. Idempotency, expiration, errors
| Status | Reason |
|--------|--------|
| 401 | Share token invalid or past `exp` — request a new one. |
| 403 | Token not intended for your application, OR session already imported into your app. |
| 404 | Original session no longer exists. |
| 404 | `workflow_id` not found in your application. |
The duplicate-import check is enforced against the (share_token, partner application) pair.
## 6. Webhooks (optional, only when Service Y wants async updates)
Service Y can register a webhook destination once via:
POST https://verification.didit.me/v3/webhook/destinations/
Body: url, subscribed_events: ["status.updated"]
Every webhook delivery carries an `X-Signature-V2` header you MUST verify before trusting the payload. HMAC-SHA256 verification MUST run against the raw body bytes (the raw payload as Didit sent it) BEFORE any JSON parsing — re-serialising the parsed body changes whitespace and key order, which invalidates the signature.
Algorithm:
1. sortKeys(payload) recursively
2. shortenFloats (truncate trailing zeros after the decimal point)
3. JSON.stringify the result
4. HMAC-SHA256 with the secret_shared_key
5. Hex-encode, compare to the X-Signature-V2 header.
## 7. Hard rules — do not change
- Base URL for /v3/* endpoints is verification.didit.me (NOT apx.didit.me).
- Auth header is x-api-key (lowercase, hyphenated).
- Webhook signature header is X-Signature-V2 (NOT X-Signature).
- Status casing matches exactly: "Approved", "Declined", "In Review", "Not Finished" (Title Case With Spaces — KYC convention).
- session_kind is lowercase: "user" or "business".
- The share API is BUSINESS-to-BUSINESS sharing. Service X and Service Y are responsible for the data-sharing legal basis under General Data Protection Regulation (GDPR), UK GDPR, and any cross-border transfer rules. Didit ships the technical capability; you ship the data-sharing agreement.
## 8. Pricing reference (public)
- Service X already paid for the original verification (full KYC bundle is $0.30 or KYB session starts at $2.00; see didit.me/pricing).
- Service Y pays nothing on the import side — `POST /v3/session/import-shared/` is included with every plan.
- 500 free verifications every month on every account (applies to fresh captures, not imports).
## 9. Verify your integration
- Sandbox starts on signup at https://business.didit.me — no separate flag.
- Create two sandbox applications: one as Service X (issuer), the other as Service Y (importer). Use Service X's API key to mint a token for a finished sandbox session, hand the token off, use Service Y's API key to import.
- Switch to live: flip each application's environment toggle in console.
When in doubt:
- https://docs.didit.me/sessions-api/share-session/overview
- https://docs.didit.me/sessions-api/share-session/share
- https://docs.didit.me/sessions-api/share-session/import
- https://docs.didit.me/core-technology/reusable-kyc/share-kyc-via-api
$0 / month. No credit card required.
Pay only for what you use. 25+ modules. Public per-module pricing, no monthly minimum fee.
Custom MSA & SLA. For large volumes and regulated programs.
Start free → pay only when a check runs → unlock Enterprise for a custom contract, SLA, or data residency.
Didit is infrastructure for identity and fraud, the platform we wished existed when we were building products ourselves: open, flexible, and developer-friendly, so it works as a real part of your stack instead of a black box you integrate around.
One API covers verifying people (KYC, know your customer), verifying businesses (KYB, know your business), screening crypto wallets (KYT, know your transaction), and monitoring transactions in real time, on a stack built to be:
The footprint underneath: 14,000+ document types in 48+ languages, 1,000+ data sources, and 200+ fraud signals on every session. The Didit infrastructure dynamically learns from every session and gets better every day.
B2B Reusable KYC lets one business hand a verified user or company to another business, so the partner onboards the same person without running the verification again.
It works in two steps:
Your partner picks the onboarding speed. Trust your decision and approve the user instantly, or pull the data raw and let their compliance team make the call.
Works for both Know Your Customer (KYC) and Know Your Business (KYB), same call, both shapes.
Full reference: docs.didit.me/sessions-api/share-session.
Any business model where one platform onboards a user once and several partner platforms need that same verification:
If you can write a data-sharing agreement with your partner, this API ships the technical half.
The full flow normally takes under 30 seconds end-to-end, pick up the ID, snap the document, snap the selfie, done. That is the fastest in the market. Legacy KYC providers usually take more than 90 seconds for the same flow.
On the back end, Didit returns the result in under two seconds at p99, measured from the moment the user finishes the selfie to the moment your webhook fires. Mobile capture is tuned for slow phones and slow networks: progressive image compression, lazy software development kit load, and a one-tap hand-off from desktop to phone via QR code if the user starts on web.
POST /v3/session/import-shared/ returns 201 Created with a brand-new session in your application, fresh session_id and session_number, full payload cloned from the source.
Key fields:
status, Approved / Declined / In Review (preserved when trust_review: true, forced to In Review when trust_review: false).session_kind, user (KYC) or business (KYB).shared_from_session, points at the original session in the source application. Canonical signal that this session was imported, not freshly captured.vendor_data, the internal user / business id YOU passed on the import call.id_verifications, liveness_checks, face_matches, aml_screenings, database_validations, proof_of_address, location_checks, phone_verifications, email_verifications.registry_checks, key_people_checks (with their nested KYCs), document_verifications, aml_screenings, questionnaires.Identical shape to a fresh session, your existing webhook handler reads it the same way.
Every session lands on one of seven clear statuses, so your code always knows what to do:
Approved, every check passed. Move the user forward.Declined, one or more checks failed. You can allow the user to resubmit the specific failed step (for example, re-take the selfie) without re-running the whole flow.In Review, flagged for compliance review. Open the case in the console, see every signal, decide approve or decline.In Progress, user is mid-flow.Not Started, link sent, user has not opened it yet. Send a reminder if it sits too long.Abandoned, user opened the link but did not finish in time. Re-engage or expire.Expired, the session link aged out. Create a new session.A signed webhook fires on every status change, so your database always stays in sync. Abandoned and declined sessions are free.
Production data is processed and stored in the European Union by default, on Amazon Web Services. Enterprise contracts can request alternative regions for jurisdictions whose regulators require it.
Encryption everywhere. AES-256 at rest across every database, object store, and backup. Transport Layer Security 1.3 in transit on every API call, webhook, and Business Console session. Biometric data is encrypted under a separate Customer Master Key.
Retention is yours to control. Default retention is indefinite (unlimited) unless you configure shorter, between 30 days and 10 years per application, and you can delete any individual session at any time from the dashboard or the API.
Certifications: SOC 2 Type 1 (Type 2 audit in progress), ISO/IEC 27001:2022, iBeta Level 1 PAD, and a public attestation from Spain''s Tesoro / SEPBLAC / CNMV that Didit''s remote identity verification is safer than verifying someone in person. Full report at /security-compliance.
Didit ships compliant by default for the regulators that matter to identity infrastructure:
Detailed memo, every certificate, every regulator letter: /security-compliance.
Three integration paths, pick whichever fits your stack:
Same dashboard, same billing, same pay-per-success price for all three. Step-by-step guide at docs.didit.me/integration/integration-prompt.
One API for KYC, KYB, Transaction Monitoring, and Wallet Screening. Integrate in 5 minutes.