# OKYC developer docs

> Add identity (KYC) and business (KYB) verification to your product with one API and a hosted flow.

Source: https://docs.okyc.stream/

<BrandHeader />

OKYC verifies people and businesses in India: PAN, Aadhaar (DigiLocker, Offline XML, Secure QR), selfie and
liveness, bank accounts, GSTIN, company registry, documents and sanctions screening. You design the steps in a
**workflow**, your backend creates a **session** for each applicant, the applicant completes the **hosted flow**
(in the browser or inside your app), and OKYC sends your backend a signed **webhook** with the decision.

- [How it works](https://docs.okyc.stream/get-started/how-it-works.md): Sessions, the hosted flow and webhooks in one picture.

- [10-minute quick start](https://docs.okyc.stream/get-started/quickstart.md): Create a test session and complete it with sandbox values.

- [Backend](https://docs.okyc.stream/backend/sessions.md): Create sessions, verify webhooks, handle errors with @okyc/node.

- [Web](https://docs.okyc.stream/web/web-sdk.md): Open the flow in a modal, inline, popup or redirect.

- [Mobile](https://docs.okyc.stream/mobile.md): Android, iOS, React Native and Flutter SDKs.

- [API reference](https://docs.okyc.stream/reference/api.md): Every endpoint, generated from the OpenAPI document.

## Golden rules

* **Secret keys stay on your server.** Browsers and apps only ever get the session `url` (it carries a
  short-lived client token), never an `sk_…` key.
* **The webhook is the decision.** Events in the browser or app are for your UI; grant access only after
  `session.approved` (or `GET /v1/sessions/:id`) on your backend.
* **Test first.** `sk_test_…` keys use mocked providers and [sandbox values](https://docs.okyc.stream/get-started/sandbox.md), cost nothing,
  and never send real OTPs.

## Always in step with the API

The API reference and the tables of events, results, failure codes, SDK options and error codes are generated
from the same definitions the API and SDKs are built from. Code samples come from example apps that are
compiled and tested. When the API or an SDK changes, these pages change with it.