Skip to main content
POST
Create verification token

Authorizations

x-api-key
string
header
required

Your partner API key (starts with cr3d_). Send it only in the x-api-key header, never as Authorization: Bearer. Keep it on your server.

Body

application/json
appKey
string
required

The app key of the app that will run the verification: your test key (zk_test_…) or your live key (zk_live_…). The app must be your team's, and the key must match your API key's environment.

Pattern: ^zk_(live|test)_[A-Za-z0-9]{32}$
Example:

"zk_test_4fK9qL2mXw7RzT1bN8cV3hJ6dY0pS5aE"

platforms
string[]
required

The platform ids to verify, in the order the user should see them. Each listed once.

Required array length: 1 - 10 elements
Pattern: ^[A-Za-z0-9._-]{1,64}$
Example:
reference
string
required

Your reference, returned unchanged in every webhook for the verification. Never put personal data in it.

Pattern: ^[A-Za-z0-9._-]{1,128}$
Example:

"order_8f3k2"

Response

Token created

token
string

vt_ followed by 43 base64url characters. Single use. The app passes it to Zktls.verify(token:).

Pattern: ^vt_[A-Za-z0-9_-]{43}$
Example:

"vt_3q2-7wGkTq0bX9aJ1mZt5yQeR8uVnC4dLhP6sFoWiYk"

expiresAt
string<date-time>

15 minutes after the token was made.