# OKYC

> OKYC is a KYC/KYB verification platform (India first): one REST API and a hosted verification flow for identity (Aadhaar, PAN, selfie liveness, face match, documents, sanctions) and business checks (GST, company registry, directors). Web, React, Node, Android, iOS, React Native and Flutter SDKs.

Key facts for agents:

- API base URL: https://api.okyc.stream (REST, JSON). Auth: `Authorization: Bearer sk_test_…` (test) or `sk_live_…` (live). Secret keys are server-side only; apps get the session `url`.
- OpenAPI 3.1: https://docs.okyc.stream/openapi.json (also https://api.okyc.stream/openapi.json).
- MCP server for AI tools: https://mcp.okyc.stream/mcp (OAuth sign-in with an OKYC account; test mode by default) — see https://docs.okyc.stream/ai/mcp.md.
- Typical flow: your backend creates a session (`POST /v1/sessions`) → the applicant completes it in the hosted flow or an SDK → you receive a signed webhook and read the result (`GET /v1/sessions/:id`).
- Test mode never calls paid providers; magic values are in the sandbox page. Registry checks without an integration are verified manually by a reviewer (`verified_by: "reviewer"`).
- Every page below is Markdown; https://docs.okyc.stream/llms-full.txt contains all of them in one file.

## Overview

- [OKYC developer docs](https://docs.okyc.stream/index.md): Add identity (KYC) and business (KYB) verification to your product with one API and a hosted flow.

## Get started

- [How it works](https://docs.okyc.stream/get-started/how-it-works.md): One session per applicant — created by your backend, completed in the hosted flow, decided by rules or a reviewer.
- [Sandbox keys and test values](https://docs.okyc.stream/get-started/sandbox.md): Test mode never calls paid providers, never sends messages and never costs anything.
- [10-minute quick start](https://docs.okyc.stream/get-started/quickstart.md): Create a test session, complete it with sandbox values and receive the webhook.

## Backend

- [Sessions](https://docs.okyc.stream/backend/sessions.md): Create a verification session for each applicant, hand its URL to your frontend, and read the result.
- [Webhooks](https://docs.okyc.stream/backend/webhooks.md): Signed, retried event deliveries — the authoritative way to learn a session's decision.
- [Idempotency](https://docs.okyc.stream/backend/idempotency.md): Retry POST requests safely with an Idempotency-Key header.
- [Errors](https://docs.okyc.stream/backend/errors.md): One error shape for every endpoint; branch on type and code, log the request id.
- [@okyc/node](https://docs.okyc.stream/backend/node-sdk.md): The server SDK for Node 18+, Bun, Deno and edge runtimes — typed, retried, never logs bodies.

## Web

- [@okyc/web](https://docs.okyc.stream/web/web-sdk.md): Open the hosted flow from any website — modal, inline, popup or redirect. Zero dependencies, under 10 KB.
- [@okyc/react](https://docs.okyc.stream/web/react.md): A button, an inline component and a hook around @okyc/web. SSR-safe.

## Mobile

- [Mobile SDKs](https://docs.okyc.stream/mobile.md): Android, iOS, React Native and Flutter wrappers around the hosted flow — one contract, the same behaviour everywhere.
- [Android](https://docs.okyc.stream/mobile/android.md): Run the verification flow in a hardened WebView from Kotlin (minSdk 24) and get a typed OkycResult.
- [iOS](https://docs.okyc.stream/mobile/ios.md): Present the verification flow from UIKit or SwiftUI (iOS 15+) and await a typed OkycResult.
- [React Native](https://docs.okyc.stream/mobile/react-native.md): A hardened react-native-webview wrapper (RN 0.74+) with a component, a modal and a promise API.
- [Flutter](https://docs.okyc.stream/mobile/flutter.md): Okyc.start pushes a full-screen verification route (Flutter 3.24+, Android and iOS) and returns a typed result.

## Concepts

- [Organizations and projects](https://docs.okyc.stream/concepts/projects.md): People belong to an organization; keys, workflows, sessions and settings belong to a project.
- [Workflows and the builder](https://docs.okyc.stream/concepts/workflows.md): A workflow is the list of steps an applicant completes and the rules that decide the outcome.
- [Decision rules](https://docs.okyc.stream/concepts/rules.md): JSONLogic rules over check results decide approved, declined or review — or fall through to the default outcome.
- [Duplicate detection](https://docs.okyc.stream/concepts/duplicates.md): Stop the same person or business from being verified twice in a project — one person, one account.
- [Document extraction and field definitions](https://docs.okyc.stream/concepts/documents.md): Collect documents and, when you opt in, extract structured fields described by rich field definitions.
- [Manual verification](https://docs.okyc.stream/concepts/manual-verification.md): Without a registry integration, PAN, bank, GST, company and Udyam checks are verified by a reviewer against a document the applicant uploads.
- [Reviewer corrections](https://docs.okyc.stream/concepts/reviewer-corrections.md): Reviewers can correct values read from uploaded documents — only before a final decision, with a full audit trail.
- [Statuses](https://docs.okyc.stream/concepts/statuses.md): The lifecycle of a session and of the checks inside it.

## AI tools

- [MCP server](https://docs.okyc.stream/ai/mcp.md): Connect Claude, Cursor, VS Code or any MCP client to OKYC — create sessions, review cases, build workflows and read the docs from your AI assistant.

## Reference

- [REST API](https://docs.okyc.stream/reference/api.md): Base URL, authentication, versioning and the OpenAPI document every page here is generated from.
- [Sessions](https://docs.okyc.stream/reference/api/sessions.md): Create, list, retrieve, decide and cancel verification sessions; evidence URLs and PII erasure.
- [Checks](https://docs.okyc.stream/reference/api/checks.md): Run a single check server-to-server, without a hosted session, and fetch its result.
- [Reference data](https://docs.okyc.stream/reference/api/reference.md): What each country supports, and the document types with their extractable fields.
- [Workflows](https://docs.okyc.stream/reference/api/workflows.md): Read your published workflows (they are built and published in the dashboard).
- [Webhooks](https://docs.okyc.stream/reference/api/webhooks.md): Manage webhook endpoints and list recent events for reconciliation.
- [Schemas](https://docs.okyc.stream/reference/api/schemas.md): Shared request and response objects of the REST API.
- [Mobile SDK contract](https://docs.okyc.stream/reference/sdk-contract.md): Results, events, failure codes, options and security defaults shared by every mobile SDK.
- [Error codes](https://docs.okyc.stream/reference/errors.md): Every error code the API can return, collected from the API source code.

## Optional

- [Full documentation](https://docs.okyc.stream/llms-full.txt): every page above in one Markdown file
- [OpenAPI specification](https://docs.okyc.stream/openapi.json): machine-readable REST API (3.1)