Skip to main content
The Partner API lets you run verification inside your own product. Your user verifies an account in a secured, iframe-based browser session, and you receive cryptographically attested proof of the result. Credentials never reach Cr3dentials servers. This guide covers the end-to-end flow. For exact request and response schemas, use the interactive API Reference.

​
Authentication

Every Partner API request authenticates with your API key:
Or with a bearer token:
Requests with a body must send Content-Type: application/json. See Authentication for full detail.

​
Response envelope

Successful responses are wrapped in a standard envelope:
Errors return the matching HTTP status with { "statusCode", "message" }.

​
The integration flow

1

List available platforms

Call GET /partner/browser-platforms to get the platforms you can verify. Use a platform’s id as platformId when creating a session.
2

Pick the applicant's country

Call GET /partner/supported-countries for the list of supported countries. Add ?country=ZA for its regions, and ?country=ZA&region=gauteng for its cities. Use these values for location.
3

Create a browser session

POST /partner/browser-session with a platformId and a required location (where your applicant is). Optionally set receiverData, expiresInHours, externalReferenceId, preferredRegion, and generateAttestation. To have Cr3dentials send the verification link to your applicant, also set notificationPlatformId (plus optional senderName/emailTemplateId). You receive an embedUrl and the resolved location.
4

Embed the session

Load the embedUrl in an iframe. The user logs in and completes verification inside the isolated browser.
5

Receive the result

Either poll GET /partner/browser-session/{id} or register a webhook in the Partner Portal to be notified when the session reaches a terminal status. On success you get extractedData (and hasAttestation: true when generateAttestation was set).
Want Cr3dentials to email or WhatsApp the verification link for you? Call GET /partner/notification-platforms for the available channels, then pass a channel’s id as notificationPlatformId along with a contact in receiverData — optionally with senderName (your business name). For email channels, call GET /partner/email-templates and pass an approved template’s id as emailTemplateId. Omit all of this to deliver the embedUrl yourself.
location is required. Set it to where your applicant actually is (country as an ISO-3166 alpha-2 code, plus optional region/city). The verification browser then runs from a residential IP in that country, so the provider sign-in looks like it came from your user — not a foreign datacenter. Use only values returned by GET /partner/supported-countries.

​
Session lifecycle

A session moves through these statuses. Poll the session or use webhooks to track it. Terminal statuses: COMPLETED, PARTIAL_COMPLETE, ERROR, CANCELLED, TERMINATED. A webhook is delivered when any terminal status is reached.
GET /partner/browser-session/{id} never returns the full attestation object. The hasAttestation flag indicates a cryptographic proof exists for the session.

​
Next steps

API Reference

Every endpoint, parameter, and schema with interactive examples.

Webhooks

Receive verification results in real time.

Rate limits

Limits and how to handle them.

Authentication

API key headers and key management.