How it works
1
Configure
Add a webhook URL in the Partner Portal. Deliveries cover every session created by your API key.
2
Verify
A user completes (or fails) their verification session.
3
Deliver
Cr3dentials sends a
POST to your URL when the session reaches a terminal status: COMPLETED, PARTIAL_COMPLETE, ERROR, CANCELLED, or TERMINATED.4
Process
Your endpoint receives the payload and updates your application.
Create a webhook in the Partner Portal
1
Open Webhooks
Log into the Partner Portal and click Webhooks in the sidebar.
2
Create a webhook
Click Create Webhook and enter your endpoint URL (
https://your-domain.com/webhook). It must be HTTPS.3
Set authentication (optional)
Add a custom header key/value (for example
X-API-Key: your-secret). Cr3dentials includes it on every delivery so you can validate the request server-side.4
Tune delivery (optional)
Set the response timeout and retry attempts, then toggle the webhook Active.
Payload
Each delivery is aPOST with this body:
The session this event is for.
Terminal status:
COMPLETED, PARTIAL_COMPLETE, ERROR, CANCELLED, or TERMINATED.Platform the session verified against.
Your reference ID from session creation, if you provided one.
Verified account data, present when verification completed.
Opaque reference to the cryptographic attestation (SHA-256). The raw attestation is never sent.
ISO 8601 completion timestamp.
Non-sensitive session metadata. Internal fields are stripped before delivery.
Handle the webhook
Requirements
Your endpoint must:Respond with a
2xx status code.Respond within the configured timeout (default 30 seconds).
Handle duplicate deliveries idempotently (key off
sessionId).Retries
Failed deliveries are retried automatically with exponential backoff, up to the retry count configured for the webhook (default 3). Review delivery history and failures under Webhooks → Logs in the portal.Troubleshooting
Not receiving notifications
Not receiving notifications
Confirm the webhook is Active, the URL is reachable over HTTPS with a valid certificate, and your server returns a
2xx. Check the delivery logs in the portal.Deliveries failing
Deliveries failing
Common causes: non-2xx responses, slow responses past the timeout, or TLS certificate problems. Inspect the logged status code and error for each attempt.
Auth header mismatch
Auth header mismatch
Make sure the header key and value in your endpoint exactly match what you configured in the portal.
