Create browser session
curl --request POST \
--url https://api.cr3dentials.xyz/partner/browser-session \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"platformId": 1,
"location": {
"country": "ZA",
"state": "gauteng",
"city": "johannesburg"
},
"channel": "remote_browser",
"receiverData": {
"name": "John Doe",
"email": "john@example.com"
},
"expiresInHours": 24,
"preferredRegion": "us-central",
"generateAttestation": false,
"notificationPlatformId": 1,
"senderName": "Acme Corporation",
"emailTemplateId": 1,
"receiverId": "user-uuid-123",
"externalReferenceId": "user_abc123"
}
'import requests
url = "https://api.cr3dentials.xyz/partner/browser-session"
payload = {
"platformId": 1,
"location": {
"country": "ZA",
"state": "gauteng",
"city": "johannesburg"
},
"channel": "remote_browser",
"receiverData": {
"name": "John Doe",
"email": "john@example.com"
},
"expiresInHours": 24,
"preferredRegion": "us-central",
"generateAttestation": False,
"notificationPlatformId": 1,
"senderName": "Acme Corporation",
"emailTemplateId": 1,
"receiverId": "user-uuid-123",
"externalReferenceId": "user_abc123"
}
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
platformId: 1,
location: {country: 'ZA', state: 'gauteng', city: 'johannesburg'},
channel: 'remote_browser',
receiverData: {name: 'John Doe', email: 'john@example.com'},
expiresInHours: 24,
preferredRegion: 'us-central',
generateAttestation: false,
notificationPlatformId: 1,
senderName: 'Acme Corporation',
emailTemplateId: 1,
receiverId: 'user-uuid-123',
externalReferenceId: 'user_abc123'
})
};
fetch('https://api.cr3dentials.xyz/partner/browser-session', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.cr3dentials.xyz/partner/browser-session",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'platformId' => 1,
'location' => [
'country' => 'ZA',
'state' => 'gauteng',
'city' => 'johannesburg'
],
'channel' => 'remote_browser',
'receiverData' => [
'name' => 'John Doe',
'email' => 'john@example.com'
],
'expiresInHours' => 24,
'preferredRegion' => 'us-central',
'generateAttestation' => false,
'notificationPlatformId' => 1,
'senderName' => 'Acme Corporation',
'emailTemplateId' => 1,
'receiverId' => 'user-uuid-123',
'externalReferenceId' => 'user_abc123'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.cr3dentials.xyz/partner/browser-session"
payload := strings.NewReader("{\n \"platformId\": 1,\n \"location\": {\n \"country\": \"ZA\",\n \"state\": \"gauteng\",\n \"city\": \"johannesburg\"\n },\n \"channel\": \"remote_browser\",\n \"receiverData\": {\n \"name\": \"John Doe\",\n \"email\": \"john@example.com\"\n },\n \"expiresInHours\": 24,\n \"preferredRegion\": \"us-central\",\n \"generateAttestation\": false,\n \"notificationPlatformId\": 1,\n \"senderName\": \"Acme Corporation\",\n \"emailTemplateId\": 1,\n \"receiverId\": \"user-uuid-123\",\n \"externalReferenceId\": \"user_abc123\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.cr3dentials.xyz/partner/browser-session")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"platformId\": 1,\n \"location\": {\n \"country\": \"ZA\",\n \"state\": \"gauteng\",\n \"city\": \"johannesburg\"\n },\n \"channel\": \"remote_browser\",\n \"receiverData\": {\n \"name\": \"John Doe\",\n \"email\": \"john@example.com\"\n },\n \"expiresInHours\": 24,\n \"preferredRegion\": \"us-central\",\n \"generateAttestation\": false,\n \"notificationPlatformId\": 1,\n \"senderName\": \"Acme Corporation\",\n \"emailTemplateId\": 1,\n \"receiverId\": \"user-uuid-123\",\n \"externalReferenceId\": \"user_abc123\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.cr3dentials.xyz/partner/browser-session")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"platformId\": 1,\n \"location\": {\n \"country\": \"ZA\",\n \"state\": \"gauteng\",\n \"city\": \"johannesburg\"\n },\n \"channel\": \"remote_browser\",\n \"receiverData\": {\n \"name\": \"John Doe\",\n \"email\": \"john@example.com\"\n },\n \"expiresInHours\": 24,\n \"preferredRegion\": \"us-central\",\n \"generateAttestation\": false,\n \"notificationPlatformId\": 1,\n \"senderName\": \"Acme Corporation\",\n \"emailTemplateId\": 1,\n \"receiverId\": \"user-uuid-123\",\n \"externalReferenceId\": \"user_abc123\"\n}"
response = http.request(request)
puts response.read_body{
"status": "success",
"data": {
"sessionId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"status": "CREATED",
"embedUrl": "https://frame.cr3dentials.xyz/verify/a1b2c3d4...?token=xxx",
"platformId": 1,
"expiresAt": "2023-11-07T05:31:56Z",
"createdAt": "2023-11-07T05:31:56Z",
"location": {
"country": "ZA",
"state": "gauteng",
"city": "johannesburg"
},
"externalReferenceId": "user_abc123"
}
}{
"statusCode": 400,
"message": "platformId must be a number"
}{
"statusCode": 401,
"message": "Unauthorized"
}{
"statusCode": 429,
"message": "Too Many Requests"
}Sessions
Create browser session
Initiates a new verification session for a given platform. Returns an embedUrl to load in an iframe. This endpoint creates iframe sessions only. Mobile SDK verifications start in the app with Zktls.verify() (see Mobile SDK), and channel: "sdk" is refused with 400 and {"code": "use_verify", "message": "SDK runs now start in the app with Zktls.verify()."}.
POST
/
partner
/
browser-session
Create browser session
curl --request POST \
--url https://api.cr3dentials.xyz/partner/browser-session \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"platformId": 1,
"location": {
"country": "ZA",
"state": "gauteng",
"city": "johannesburg"
},
"channel": "remote_browser",
"receiverData": {
"name": "John Doe",
"email": "john@example.com"
},
"expiresInHours": 24,
"preferredRegion": "us-central",
"generateAttestation": false,
"notificationPlatformId": 1,
"senderName": "Acme Corporation",
"emailTemplateId": 1,
"receiverId": "user-uuid-123",
"externalReferenceId": "user_abc123"
}
'import requests
url = "https://api.cr3dentials.xyz/partner/browser-session"
payload = {
"platformId": 1,
"location": {
"country": "ZA",
"state": "gauteng",
"city": "johannesburg"
},
"channel": "remote_browser",
"receiverData": {
"name": "John Doe",
"email": "john@example.com"
},
"expiresInHours": 24,
"preferredRegion": "us-central",
"generateAttestation": False,
"notificationPlatformId": 1,
"senderName": "Acme Corporation",
"emailTemplateId": 1,
"receiverId": "user-uuid-123",
"externalReferenceId": "user_abc123"
}
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
platformId: 1,
location: {country: 'ZA', state: 'gauteng', city: 'johannesburg'},
channel: 'remote_browser',
receiverData: {name: 'John Doe', email: 'john@example.com'},
expiresInHours: 24,
preferredRegion: 'us-central',
generateAttestation: false,
notificationPlatformId: 1,
senderName: 'Acme Corporation',
emailTemplateId: 1,
receiverId: 'user-uuid-123',
externalReferenceId: 'user_abc123'
})
};
fetch('https://api.cr3dentials.xyz/partner/browser-session', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.cr3dentials.xyz/partner/browser-session",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'platformId' => 1,
'location' => [
'country' => 'ZA',
'state' => 'gauteng',
'city' => 'johannesburg'
],
'channel' => 'remote_browser',
'receiverData' => [
'name' => 'John Doe',
'email' => 'john@example.com'
],
'expiresInHours' => 24,
'preferredRegion' => 'us-central',
'generateAttestation' => false,
'notificationPlatformId' => 1,
'senderName' => 'Acme Corporation',
'emailTemplateId' => 1,
'receiverId' => 'user-uuid-123',
'externalReferenceId' => 'user_abc123'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.cr3dentials.xyz/partner/browser-session"
payload := strings.NewReader("{\n \"platformId\": 1,\n \"location\": {\n \"country\": \"ZA\",\n \"state\": \"gauteng\",\n \"city\": \"johannesburg\"\n },\n \"channel\": \"remote_browser\",\n \"receiverData\": {\n \"name\": \"John Doe\",\n \"email\": \"john@example.com\"\n },\n \"expiresInHours\": 24,\n \"preferredRegion\": \"us-central\",\n \"generateAttestation\": false,\n \"notificationPlatformId\": 1,\n \"senderName\": \"Acme Corporation\",\n \"emailTemplateId\": 1,\n \"receiverId\": \"user-uuid-123\",\n \"externalReferenceId\": \"user_abc123\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.cr3dentials.xyz/partner/browser-session")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"platformId\": 1,\n \"location\": {\n \"country\": \"ZA\",\n \"state\": \"gauteng\",\n \"city\": \"johannesburg\"\n },\n \"channel\": \"remote_browser\",\n \"receiverData\": {\n \"name\": \"John Doe\",\n \"email\": \"john@example.com\"\n },\n \"expiresInHours\": 24,\n \"preferredRegion\": \"us-central\",\n \"generateAttestation\": false,\n \"notificationPlatformId\": 1,\n \"senderName\": \"Acme Corporation\",\n \"emailTemplateId\": 1,\n \"receiverId\": \"user-uuid-123\",\n \"externalReferenceId\": \"user_abc123\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.cr3dentials.xyz/partner/browser-session")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"platformId\": 1,\n \"location\": {\n \"country\": \"ZA\",\n \"state\": \"gauteng\",\n \"city\": \"johannesburg\"\n },\n \"channel\": \"remote_browser\",\n \"receiverData\": {\n \"name\": \"John Doe\",\n \"email\": \"john@example.com\"\n },\n \"expiresInHours\": 24,\n \"preferredRegion\": \"us-central\",\n \"generateAttestation\": false,\n \"notificationPlatformId\": 1,\n \"senderName\": \"Acme Corporation\",\n \"emailTemplateId\": 1,\n \"receiverId\": \"user-uuid-123\",\n \"externalReferenceId\": \"user_abc123\"\n}"
response = http.request(request)
puts response.read_body{
"status": "success",
"data": {
"sessionId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"status": "CREATED",
"embedUrl": "https://frame.cr3dentials.xyz/verify/a1b2c3d4...?token=xxx",
"platformId": 1,
"expiresAt": "2023-11-07T05:31:56Z",
"createdAt": "2023-11-07T05:31:56Z",
"location": {
"country": "ZA",
"state": "gauteng",
"city": "johannesburg"
},
"externalReferenceId": "user_abc123"
}
}{
"statusCode": 400,
"message": "platformId must be a number"
}{
"statusCode": 401,
"message": "Unauthorized"
}{
"statusCode": 429,
"message": "Too Many Requests"
}Authorizations
Your partner API key (starts with cr3d_). Send it only in the x-api-key header, never as Authorization: Bearer. Keep it on your server.
Body
application/json
Platform ID from the platforms endpoint.
Example:
1
Required. Where your applicant is — the verification runs from a residential IP in this country so the provider sign-in looks like your user, not a foreign datacenter. Use values from GET /partner/supported-countries.
Show child attributes
Show child attributes
remote_browser, the default: an iframe session. You can leave it out. sdk is refused with 400 and the code use_verify: mobile SDK verifications start in the app with Zktls.verify().
Available options:
remote_browser Metadata about the person performing verification (name, email, phone, etc.).
Example:
{
"name": "John Doe",
"email": "john@example.com"
}
Session TTL in hours (1–168). Defaults to the maximum if omitted.
Required range:
1 <= x <= 168Example:
24
Preferred compute region for the browser. Overrides the region otherwise derived from location. Omit to auto-select the closest region for lowest latency.
Available options:
us-central, us-west, us-east, asia-south, europe-west Example:
"us-central"
When true, the session also produces a zkTLS attestation of the collected data. Defaults to false (raw data only). When set, the completed session exposes hasAttestation: true and webhooks include a proofHash.
Example:
false
Notification channel used to send the verification link to your applicant on your behalf (e.g. email or WhatsApp). Requires receiverData with the applicant's contact. Omit to deliver the embedUrl yourself.
Example:
1
Business name shown as the sender in the verification notification. Only applies when notificationPlatformId is set. Defaults to "Cr3dentials".
Example:
"Acme Corporation"
Approved email template for the verification notification. Only applies when notificationPlatformId is an email channel. Falls back to the team or system default.
Example:
1
User ID of a registered Cr3dentials receiver to link this session to. Leave unset for external applicants and identify them via receiverData.
Example:
"user-uuid-123"
Your internal reference ID for tracking this session. Included in webhook payloads and responses.
Example:
"user_abc123"