> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cr3dentials.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Create verification token

> Prepares a mobile SDK verification on your server. Pass the token to your app, which starts the verification with `Zktls.verify(token:)` (Swift) or `Zktls.verify(activity, token)` (Kotlin). The token carries the platforms and the reference, is single use, and expires after 15 minutes. A Development API key creates tokens for your test app key, and a Production API key for your live app key. The response is the object itself, not inside the `status`/`data` envelope. See [Verifications](/api-reference/verifications).



## OpenAPI

````yaml /api-reference/openapi.json post /partner/verification-tokens
openapi: 3.1.0
info:
  title: Cr3dentials Partner API
  description: >-
    Integrate account verification into your application. Users verify their
    accounts through an iframe-based browser session, and you receive
    cryptographically attested proof of data authenticity.
  version: 1.0.0
  contact:
    name: Cr3dentials Support
    url: https://cr3dentials.xyz
servers:
  - url: https://app.cr3dentials.xyz/v1
    description: Production
  - url: https://staging.cr3dentials.xyz/v1
    description: Staging
security:
  - apiKey: []
paths:
  /partner/verification-tokens:
    post:
      tags:
        - Verifications
      summary: Create verification token
      description: >-
        Prepares a mobile SDK verification on your server. Pass the token to
        your app, which starts the verification with `Zktls.verify(token:)`
        (Swift) or `Zktls.verify(activity, token)` (Kotlin). The token carries
        the platforms and the reference, is single use, and expires after 15
        minutes. A Development API key creates tokens for your test app key, and
        a Production API key for your live app key. The response is the object
        itself, not inside the `status`/`data` envelope. See
        [Verifications](/api-reference/verifications).
      operationId: createVerificationToken
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateVerificationTokenRequest'
      responses:
        '201':
          description: Token created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VerificationToken'
        '400':
          description: >-
            The body is invalid: a field is missing, of the wrong type, or
            unknown.
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          description: >-
            The app key doesn't match your API key's environment: a live key
            with a Development API key, or a test key with a Production API key.
        '404':
          description: No app of your team has this app key.
        '429':
          $ref: '#/components/responses/RateLimited'
        '503':
          description: We couldn't make the token just now. Try again.
components:
  schemas:
    CreateVerificationTokenRequest:
      type: object
      required:
        - appKey
        - platforms
        - reference
      properties:
        appKey:
          type: string
          description: >-
            The app key of the app that will run the verification: your test key
            (`zk_test_…`) or your live key (`zk_live_…`). The app must be your
            team's, and the key must match your API key's environment.
          pattern: ^zk_(live|test)_[A-Za-z0-9]{32}$
          example: zk_test_4fK9qL2mXw7RzT1bN8cV3hJ6dY0pS5aE
        platforms:
          type: array
          description: >-
            The platform ids to verify, in the order the user should see them.
            Each listed once.
          items:
            type: string
            pattern: ^[A-Za-z0-9._-]{1,64}$
          minItems: 1
          maxItems: 10
          uniqueItems: true
          example:
            - zktls-demo
        reference:
          type: string
          description: >-
            Your reference, returned unchanged in every webhook for the
            verification. Never put personal data in it.
          pattern: ^[A-Za-z0-9._-]{1,128}$
          example: order_8f3k2
    VerificationToken:
      type: object
      properties:
        token:
          type: string
          description: >-
            `vt_` followed by 43 base64url characters. Single use. The app
            passes it to `Zktls.verify(token:)`.
          pattern: ^vt_[A-Za-z0-9_-]{43}$
          example: vt_3q2-7wGkTq0bX9aJ1mZt5yQeR8uVnC4dLhP6sFoWiYk
        expiresAt:
          type: string
          format: date-time
          description: 15 minutes after the token was made.
  responses:
    Unauthorized:
      description: Missing or invalid API key
      content:
        application/json:
          example:
            statusCode: 401
            message: Unauthorized
    RateLimited:
      description: Too many requests — 120 req / 60s per API key. Use exponential backoff.
      content:
        application/json:
          example:
            statusCode: 429
            message: Too Many Requests
  securitySchemes:
    apiKey:
      type: apiKey
      in: header
      name: x-api-key
      description: >-
        Your partner API key (starts with `cr3d_`). Send it only in the
        `x-api-key` header, never as `Authorization: Bearer`. Keep it on your
        server.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.