# API Reference
Source: https://docs.cr3dentials.xyz/api-reference/introduction
Base URLs, authentication, and conventions for the Partner API.
The Partner API is a REST API over HTTPS. All responses are JSON wrapped in a standard envelope.
## Base URLs
| Environment | Base URL |
| ----------- | ------------------------------------ |
| Production | `https://app.cr3dentials.xyz/v1` |
| Staging | `https://staging.cr3dentials.xyz/v1` |
## Authentication
Every request authenticates with your partner API key via the `x-api-key` header (or `Authorization: Bearer`). See [Authentication](/authentication) for details.
```
x-api-key: your_api_key_here
```
## Conventions
* **Envelope.** Successful responses look like `{ "status": "success", "data": ... }`.
* **Timestamps.** All timestamps are ISO 8601 strings in UTC.
* **Errors.** Failures return the appropriate HTTP status with `{ "statusCode", "message" }`.
* **Rate limits.** 120 requests / 60 seconds per API key. See [Rate Limits](/essentials/rate-limits).
Use the endpoints in the sidebar to explore parameters, schemas, and try requests interactively.
# Get approved email templates
Source: https://docs.cr3dentials.xyz/api-reference/platforms/get-approved-email-templates
/api-reference/openapi.json get /partner/email-templates
Returns your team's APPROVED email templates. Use a template's `id` as `emailTemplateId` when creating a session with an email `notificationPlatformId`.
# Get available platforms
Source: https://docs.cr3dentials.xyz/api-reference/platforms/get-available-platforms
/api-reference/openapi.json get /partner/browser-platforms
Retrieves the list of verification platforms available for browser sessions.
# Get notification platforms
Source: https://docs.cr3dentials.xyz/api-reference/platforms/get-notification-platforms
/api-reference/openapi.json get /partner/notification-platforms
Returns the active notification channels (e.g. email, WhatsApp). Use a channel's `id` as `notificationPlatformId` when creating a session to have Cr3dentials send the verification link to your applicant.
# Create browser session
Source: https://docs.cr3dentials.xyz/api-reference/sessions/create-browser-session
/api-reference/openapi.json post /partner/browser-session
Initiates a new verification session for a given platform. Returns an `embedUrl` to load in an iframe.
# Get browser session
Source: https://docs.cr3dentials.xyz/api-reference/sessions/get-browser-session
/api-reference/openapi.json get /partner/browser-session/{id}
Retrieves the current status and results of a browser session. Poll this endpoint to detect completion or check verification results.
# Get session recording
Source: https://docs.cr3dentials.xyz/api-reference/sessions/get-session-recording
/api-reference/openapi.json get /partner/browser-session/{id}/recording
Returns a fresh, time-limited video recording URL for a browser session that ended in an error state. Recordings are only exposed for sessions whose status is `ERROR` — use this to review what the applicant saw when a verification failed. The URL is a presigned link generated on demand and expires roughly 7 days after it is issued, so fetch it when you need it rather than storing it. If the recording is still being processed, `status` is `pending` or `in_progress`; poll again shortly, and once `status` is `completed`, `recordingUrl` contains the MP4 download link. Returns 404 if the session does not exist, is not owned by your API key, is not in the `ERROR` state, or never started a browser session.
# List browser sessions
Source: https://docs.cr3dentials.xyz/api-reference/sessions/list-browser-sessions
/api-reference/openapi.json get /partner/browser-sessions
Returns a paginated list of browser sessions created by your API key.
# List supported countries
Source: https://docs.cr3dentials.xyz/api-reference/sessions/list-supported-countries
/api-reference/openapi.json get /partner/supported-countries
Countries where verification sessions are supported. Pass `country` for its regions, and `country`+`region` for its cities. Use these values for the required `location` field when creating a session.
# Terminate browser session
Source: https://docs.cr3dentials.xyz/api-reference/sessions/terminate-browser-session
/api-reference/openapi.json delete /partner/browser-session/{id}
Ends a session early and releases its remote browser immediately instead of waiting for expiry. Use it when your applicant abandons the flow or you cancel the check on your side. The call is idempotent: a session that already reached a terminal status is left untouched and its existing status is returned. Any live iframe embed is disconnected.
# Authentication
Source: https://docs.cr3dentials.xyz/authentication
Authenticate every Partner API request with your API key.
All Partner API endpoints require authentication with your partner API key.
## API key header
```
x-api-key: your_api_key_here
```
Alternatively, use the `Authorization` header:
```
Authorization: Bearer your_api_key_here
```
All requests with a body must also include:
```
Content-Type: application/json
```
## Response envelope
Every successful response is wrapped in a standard envelope:
```json theme={null}
{
"status": "success",
"data": { }
}
```
Error responses return the appropriate HTTP status code with details in the body:
```json theme={null}
{
"statusCode": 401,
"message": "Unauthorized"
}
```
## Managing keys
Treat your API key like a password. Never expose it in client-side code or commit it to source control.
API keys can be rotated at any time from your [dashboard](https://app.cr3dentials.xyz). Rotating a key immediately invalidates the previous one.
# Rate Limits
Source: https://docs.cr3dentials.xyz/essentials/rate-limits
Fair-usage limits, response headers, and how to handle them.
The API enforces rate limits to keep access fast and reliable for every partner. Limits cap how many requests you can make in a time window; exceeding one returns a temporary `429` until the window resets.
## Limits
* **Global limit:** 120 requests per 60 seconds per API key.
* Session creation and bulk operations have additional per-endpoint limits.
Your exact limits can vary with your plan and key configuration.
## Response headers
Every response includes your current rate-limit status:
```http theme={null}
X-RateLimit-Limit: 120
X-RateLimit-Remaining: 95
X-RateLimit-Reset: 1625097600
```
| Header | Meaning |
| ----------------------- | ----------------------------------------------- |
| `X-RateLimit-Limit` | Maximum requests allowed in the current window. |
| `X-RateLimit-Remaining` | Requests left in the current window. |
| `X-RateLimit-Reset` | Unix timestamp when the window resets. |
## When you're limited
A throttled request returns `429 Too Many Requests`:
```json theme={null}
{
"statusCode": 429,
"message": "Too Many Requests"
}
```
Implement exponential backoff with jitter. Start around 1s and double on each retry
(1s, 2s, 4s, 8s) up to a sensible ceiling. Read `X-RateLimit-Reset` to wait exactly until
the window resets instead of guessing.
## Best practices
Cache platform lists and other rarely-changing data instead of refetching.
Prefer [webhooks](/essentials/webhooks) over polling to cut request volume.
Watch `X-RateLimit-Remaining` and slow down before you hit zero.
# Webhooks
Source: https://docs.cr3dentials.xyz/essentials/webhooks
Receive verification results in real time instead of polling.
Webhooks notify your endpoint the moment a verification session reaches a terminal status. Configure a webhook once and you stop polling for results.
## How it works
Add a webhook URL in the Partner Portal. Deliveries cover every session created by your API key.
A user completes (or fails) their verification session.
Cr3dentials sends a `POST` to your URL when the session reaches a terminal status: `COMPLETED`, `PARTIAL_COMPLETE`, `ERROR`, `CANCELLED`, or `TERMINATED`.
Your endpoint receives the payload and updates your application.
## Create a webhook in the Partner Portal
Log into the [Partner Portal](https://app.cr3dentials.xyz) and click **Webhooks** in the sidebar.
Click **Create Webhook** and enter your endpoint URL (`https://your-domain.com/webhook`). It must be HTTPS.
Add a custom header key/value (for example `X-API-Key: your-secret`). Cr3dentials includes it on every delivery so you can validate the request server-side.
Set the response timeout and retry attempts, then toggle the webhook **Active**.
You can create a webhook inactive and enable it later. Use the **Test** action in the
portal to send a sample payload and confirm your endpoint responds.
## Payload
Each delivery is a `POST` with this body:
```json theme={null}
{
"sessionId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"status": "COMPLETED",
"platformId": 1,
"externalReferenceId": "user_abc123",
"extractedData": {
"accountHolder": "John Doe",
"accountType": "checking"
},
"proofHash": "9f2c…",
"completedAt": "2025-03-24T12:05:00.000Z",
"metadata": {}
}
```
The session this event is for.
Terminal status: `COMPLETED`, `PARTIAL_COMPLETE`, `ERROR`, `CANCELLED`, or `TERMINATED`.
Platform the session verified against.
Your reference ID from session creation, if you provided one.
Verified account data, present when verification completed.
Opaque reference to the cryptographic attestation (SHA-256). The raw attestation is never sent.
ISO 8601 completion timestamp.
Non-sensitive session metadata. Internal fields are stripped before delivery.
## Handle the webhook
```javascript theme={null}
// Node.js / Express
app.post('/webhook/cr3dentials', (req, res) => {
// Validate the auth header you configured in the portal
if (req.headers['x-api-key'] !== process.env.CR3D_WEBHOOK_SECRET) {
return res.status(401).json({ error: 'Invalid signature' });
}
// Acknowledge immediately, process asynchronously
res.status(200).json({ received: true });
const { sessionId, status, extractedData } = req.body;
setImmediate(() => updateVerification(sessionId, status, extractedData));
});
```
## Requirements
Your endpoint must:
Respond with a `2xx` status code.
Respond within the configured timeout (default 30 seconds).
Handle duplicate deliveries idempotently (key off `sessionId`).
Always validate the configured authentication header server-side before trusting a
payload. Acknowledge fast and do heavy work asynchronously so you don't hit the timeout.
## Retries
Failed deliveries are retried automatically with exponential backoff, up to the retry count configured for the webhook (default 3). Review delivery history and failures under **Webhooks → Logs** in the portal.
## Troubleshooting
Confirm the webhook is **Active**, the URL is reachable over HTTPS with a valid certificate, and your server returns a `2xx`. Check the delivery logs in the portal.
Common causes: non-2xx responses, slow responses past the timeout, or TLS certificate problems. Inspect the logged status code and error for each attempt.
Make sure the header key and value in your endpoint exactly match what you configured in the portal.
# How Cr3dentials Works
Source: https://docs.cr3dentials.xyz/getting-started/how-it-works
How Cr3dentials uses zkTLS and zero-knowledge proofs to verify data from web-based platforms without exposing login credentials or raw data.
Cr3dentials uses **zkTLS** to run private, tamper-proof verifications directly from web-based platforms. zkTLS stands for zero-knowledge Transport Layer Security. It lets users generate a proof of what they see during a secure HTTPS session without revealing the full content of that session.
This means users can prove facts like revenue, activity, or account ownership from dashboards like YouTube Studio or Shopify Admin without exposing their login credentials or sharing raw data.
## The three parties
The verifier is the organization requesting the verification. This could be a lender, fintech platform, marketplace, or any service that needs to validate user claims before providing access to capital, services, or opportunities.
The verifier defines:
* **What needs to be proven**, such as revenue, payout consistency, or account age.
* **Which platforms are acceptable.**
* **How much data they want to see**, using Cr3dentials' selective disclosure feature:
* Full details, such as exact income values and payout history.
* Specific data points, such as account creation date or monthly average.
* Binary thresholds only, such as whether a user earns more than \$5,000 per month.
The applicant is the person being verified. They receive a secure link to complete the verification. From there, they choose a supported platform, connect their account, and approve the session.
Cr3dentials runs locally in their browser and handles everything without routing data through centralized servers. Users never share login credentials with Cr3dentials. They stay in full control of what is verified and can optionally store encrypted access tokens for future sessions.
Data sources are the platforms the applicant connects to, such as social media accounts, e-commerce and accounting tools, payroll, and banking.
Cr3dentials loads these dashboards in a secure browser environment and extracts the required data using zkTLS. Instead of returning the raw data, Cr3dentials generates a zero-knowledge proof that the information on the page satisfies the verifier's conditions.
## User flow
The user journey is short.
The verifier initiates a verification request and shares a unique link with the applicant.
The applicant clicks the link and is redirected to the Cr3dentials appclip or mobile app.
The applicant selects the platform they want to verify, logs in, and authorizes data access.
Cr3dentials fetches the required data in a secure zkTLS session and generates a proof.
The zero-knowledge proof is automatically sent to the verifier once verification is complete.
# Quickstart
Source: https://docs.cr3dentials.xyz/getting-started/quickstart
Start verifying users with the no-code dashboard or the Partner API.
Cr3dentials gives you two ways to start verifying users:
* **No-code** through the Cr3dentials dashboard
* **API integration** for building verification into your product or backend
Email [info@cr3dentials.xyz](mailto:info@cr3dentials.xyz) to approve your email for a partner account, then sign up at [app.cr3dentials.xyz](https://app.cr3dentials.xyz).
Open **Settings** and configure the data sources you want your users to verify from.
Go to the **Reviewer** tab and click **New Request**. Fill in the applicant's details and the verification expiration time.
The applicant receives an email or WhatsApp message with a link to verify their credentials.
Once the applicant completes the session, results appear in your dashboard. You can download a copy or store the proof.
Use this path to build Cr3dentials into your product flow or backend systems.
1. Email [info@cr3dentials.xyz](mailto:info@cr3dentials.xyz) to approve your email for a partner account.
2. Log into the [dashboard](https://app.cr3dentials.xyz).
3. Go to the **Partner** section and click **Create a Team**.
4. Open **View all keys**.
5. Generate and copy your API key.
Every request authenticates with this key:
```
x-api-key: your_api_key_here
```
Platforms tell you which accounts can be verified. Use the returned `id` as `platformId`.
```bash theme={null}
curl https://app.cr3dentials.xyz/v1/partner/browser-platforms \
-H "x-api-key: $CR3D_API_KEY"
```
Get the countries you can run a verification from. Use a returned `country_code` for `location`.
```bash theme={null}
curl https://app.cr3dentials.xyz/v1/partner/supported-countries \
-H "x-api-key: $CR3D_API_KEY"
```
```bash theme={null}
curl -X POST https://app.cr3dentials.xyz/v1/partner/browser-session \
-H "x-api-key: $CR3D_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"platformId": 1,
"receiverData": { "name": "John Doe", "email": "john@example.com" },
"location": { "country": "ZA", "city": "johannesburg" },
"expiresInHours": 24,
"externalReferenceId": "user_abc123"
}'
```
**`location` is required** — set it to where your applicant is (`country` as ISO-3166
alpha-2, plus optional `region`/`city`). The verification runs from a residential IP in
that country so the sign-in looks like your user, not a foreign datacenter.
The response contains an `embedUrl` and the resolved `location`:
```json theme={null}
{
"status": "success",
"data": {
"sessionId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"status": "CREATED",
"embedUrl": "https://frame.cr3dentials.xyz/verify/a1b2c3d4...?token=xxx",
"platformId": 1,
"expiresAt": "2025-03-25T12:00:00.000Z",
"createdAt": "2025-03-24T12:00:00.000Z",
"location": { "country": "ZA", "city": "johannesburg" },
"externalReferenceId": "user_abc123"
}
}
```
Render the `embedUrl` in an iframe. The user completes login and verification inside it.
```html theme={null}
```
Either poll the session or receive a [webhook](/essentials/webhooks) when it reaches a terminal status.
```bash theme={null}
curl https://app.cr3dentials.xyz/v1/partner/browser-session/a1b2c3d4-e5f6-7890-abcd-ef1234567890 \
-H "x-api-key: $CR3D_API_KEY"
```
When `status` is `COMPLETED`, `extractedData` holds the verified account data and `hasAttestation` is `true`.
See every endpoint, parameter, and response in the API reference.
# API Integration Guide
Source: https://docs.cr3dentials.xyz/guides/api-integration
Integrate iframe-based verification into your product with the Partner API.
The Partner API lets you run verification inside your own product. Your user verifies an account in a secured, iframe-based browser session, and you receive cryptographically attested proof of the result. Credentials never reach Cr3dentials servers.
This guide covers the end-to-end flow. For exact request and response schemas, use the interactive [API Reference](/api-reference/introduction).
## Authentication
Every Partner API request authenticates with your API key:
```
x-api-key: your_api_key_here
```
Or with a bearer token:
```
Authorization: Bearer your_api_key_here
```
Requests with a body must send `Content-Type: application/json`. See [Authentication](/authentication) for full detail.
## Response envelope
Successful responses are wrapped in a standard envelope:
```json theme={null}
{
"status": "success",
"data": { }
}
```
Errors return the matching HTTP status with `{ "statusCode", "message" }`.
## The integration flow
Call `GET /partner/browser-platforms` to get the platforms you can verify. Use a platform's `id` as `platformId` when creating a session.
Call `GET /partner/supported-countries` for the list of supported countries. Use a returned `country_code` for `location.country`.
`POST /partner/browser-session` with a `platformId` and a **required** `location` (where your applicant is). Optionally set `receiverData`, `expiresInHours`, `externalReferenceId`, `preferredRegion`, and `generateAttestation`. To have Cr3dentials send the verification link to your applicant, also set `notificationPlatformId` (plus optional `senderName`/`emailTemplateId`). You receive an `embedUrl` and the resolved `location`.
Load the `embedUrl` in an iframe. The user logs in and completes verification inside the isolated browser.
Either poll `GET /partner/browser-session/{id}` or register a [webhook](/essentials/webhooks) in the Partner Portal to be notified when the session reaches a terminal status. On success you get `extractedData` (and `hasAttestation: true` when `generateAttestation` was set).
```bash theme={null}
curl -X POST https://app.cr3dentials.xyz/v1/partner/browser-session \
-H "x-api-key: $CR3D_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"platformId": 1,
"receiverData": { "name": "John Doe", "email": "john@example.com" },
"location": { "country": "ZA", "city": "johannesburg" },
"expiresInHours": 24,
"generateAttestation": true,
"externalReferenceId": "user_abc123"
}'
```
Want Cr3dentials to email or WhatsApp the verification link for you? Call
`GET /partner/notification-platforms` for the available channels, then pass a
channel's `id` as `notificationPlatformId` along with a contact in `receiverData`
— optionally with `senderName` (your business name). For email channels, call
`GET /partner/email-templates` and pass an approved template's `id` as
`emailTemplateId`. Omit all of this to deliver the `embedUrl` yourself.
**`location` is required.** Set it to where your applicant actually is (`country` as an
ISO-3166 alpha-2 code, plus optional `region`/`city`). The verification browser then runs
from a residential IP in that country, so the provider sign-in looks like it came from your
user — not a foreign datacenter. Use only values returned by `GET /partner/supported-countries`.
## Session lifecycle
A session moves through these statuses. Poll the session or use [webhooks](/essentials/webhooks) to track it.
| Status | Description |
| ----------------- | ------------------------------------------------------------ |
| `CREATED` | Session created, browser environment not yet assigned. |
| `INITIALIZING` | Browser environment spinning up. |
| `READY` | Browser ready, waiting for the user to connect. |
| `CONNECTED` | User connected via iframe and can interact with the browser. |
| `LOADING_TREE` | Session agent is loading the verification workflow. |
| `RUNNING` | Executing verification steps. |
| `AWAITING_USER` | Waiting for user action (login, 2FA, security questions). |
| `COLLECTING_DATA` | Extracting account data after successful login. |
| `VERIFYING` | Generating cryptographic attestation. |
**Terminal statuses:** `COMPLETED`, `PARTIAL_COMPLETE`, `ERROR`, `CANCELLED`, `TERMINATED`. A webhook is delivered when any terminal status is reached.
`GET /partner/browser-session/{id}` never returns the full attestation object. The
`hasAttestation` flag indicates a cryptographic proof exists for the session.
## Terminating a session
To end a session early — the applicant abandoned the flow, or you cancelled the check on
your side — terminate it so its remote browser is released immediately instead of waiting
for expiry.
```bash theme={null}
curl -X DELETE https://app.cr3dentials.xyz/v1/partner/browser-session/{id} \
-H "x-api-key: $CR3D_API_KEY"
```
```json theme={null}
{
"status": "success",
"data": { "sessionId": "...", "status": "TERMINATED" }
}
```
The call is idempotent: a session that already reached a terminal status is left alone and
its existing `status` is returned. Any live iframe embed is disconnected.
## Debugging failed sessions
When a session ends in `ERROR`, fetch a video recording of the browser to see what your
applicant encountered.
```bash theme={null}
curl https://app.cr3dentials.xyz/v1/partner/browser-session/{id}/recording \
-H "x-api-key: $CR3D_API_KEY"
```
The response reports the recording's processing `status`. Once it is `completed`,
`recordingUrl` holds a presigned MP4 link:
```json theme={null}
{
"status": "success",
"data": {
"status": "completed",
"recordingUrl": "https://.../recording.mp4?X-Amz-Signature=...",
"error": null
}
}
```
Recordings are only available for sessions in the `ERROR` state. The `recordingUrl` is
presigned and expires about 7 days after it is issued, so fetch it when you need it rather
than storing it. If `status` is `pending` or `in_progress`, the recording is still
processing — poll again shortly.
## Next steps
Every endpoint, parameter, and schema with interactive examples.
Receive verification results in real time.
Limits and how to handle them.
API key headers and key management.
# Partner Portal Guide
Source: https://docs.cr3dentials.xyz/guides/partner-portal
Manage your team and API keys in the Cr3dentials Partner Portal.
The Partner Portal gives you tools to manage your team and API keys. This guide covers the features you need to get started quickly and securely.
## Team Management
### Create your first team
Log into your partner account and go to the main dashboard.
Find the "Create Your Team" card on the dashboard and click **Create Team**.
Enter a descriptive team name, add an optional description for context, then click **Create Team** to finalize.
### Invite team members
Go to the **Team Members** section from your dashboard.
Click **Invite Team Member**, enter the member's email address, add an optional personal message, then click **Send Invitation**.
Invited members receive an email with an acceptance link. They join your team by clicking the link and following the prompts.
### Team roles
| Role | Access |
| ------ | ------------------------------------- |
| Owner | Full administrative access. |
| Admin | Can manage team members and API keys. |
| Member | Basic access to team resources. |
From the Team Overview you can view all members, change member roles (Owner and Admin only), remove members, and monitor member activity.
## API Key Management
API keys provide full access to your data. Handle them with care and never share them publicly.
### Create an API key
Go to the **API Keys** section in your dashboard.
Click **Create API Key**.
Set the following:
* **Name**: a descriptive name, for example "Production App" or "Development Testing".
* **Environment**: Development for testing, or Production for live applications.
* **Expiration**: Never expires, 30 days, 90 days, or 180 days.
Click **Generate API Key**. Copy and save the key immediately. You cannot view it again after this step.
### Manage existing keys
In the API Keys section you can see each key's name and description, environment type (Dev or Prod), creation date, expiration date, last used timestamp, and usage statistics.
For each key you can:
* **View Usage**: see detailed usage statistics.
* **Monitor Activity**: check the last used timestamp.
* **Revoke Key**: immediately disable the key if it is compromised.
### Usage analytics
Click **View Usage** for any API key.
Available metrics include total number of requests, usage limits (if configured), request patterns over time, and error rates with status codes.
## Security Best Practices
### Team security
Create teams for better access control. Assign roles based on responsibilities. Audit team membership regularly. Remove inactive or departed members promptly.
Do not share individual accounts between team members, grant unnecessary administrative privileges, or leave inactive members in your team.
### API key security
Use descriptive, meaningful names for keys. Set expiration dates. Separate development and production keys. Monitor usage regularly. Rotate keys periodically. Store keys in secure environment variables.
Do not commit API keys to version control, share keys via email or chat, reuse the same key across multiple environments, or keep unused or old keys active.
### Security incident response
If you suspect an API key has been compromised:
Revoke the compromised key immediately.
Create a replacement key with a new name.
Replace the old key in all applications.
Watch for any unusual activity.
Contact support if you notice unauthorized usage.
## Quick Reference
### Team setup checklist
* [ ] Create your team
* [ ] Invite necessary team members
* [ ] Assign appropriate roles
* [ ] Set up team guidelines
### API key setup checklist
* [ ] Create a development API key
* [ ] Create a production API key (when ready)
* [ ] Store keys securely
* [ ] Configure keys in your applications
* [ ] Set up usage monitoring
Bookmark this guide for quick reference as you set up and manage your partner account.
## Need Help?
If you run into issues or have questions:
Reference for the Cr3dentials API.
Reach the Cr3dentials team.
# Introduction
Source: https://docs.cr3dentials.xyz/introduction
Cr3dentials verifies income, work history, and reputation from any web-based account using zkTLS and zero-knowledge proofs, without exposing the underlying data.
Cr3dentials is a cryptographically secure verification platform. It lets you verify identity, income, and employment from any web-based account using real-time data and zero-knowledge proofs. If it starts with HTTPS, we can verify it.
If you're building for creators, freelancers, gig drivers, remote salaried workers or online businesses, Cr3dentials gives you privacy-preserving proofs you can trust. We turn platform native dashboards and payment records into verifiable credentials without exposing the raw data behind them.
Create your first verification request.
Integrate Cr3dentials into your platform using our API.
Explore supported platforms like YouTube, Deel, and Shopify.
Learn how zero-knowledge proofs verify data without exposing it.
## How it works at a glance
All verifications happen locally and are proven through zero-knowledge circuits. Only the user can access their raw data. Only the result of the proof is shared with the verifier.
## Choose your level of data visibility
Lenders and platforms pick how much they want to see. You can:
* **View the full proof output**, including raw values.
* **Receive only specific data points** relevant to your decision.
* **See nothing beyond a pass or fail threshold**, such as income above a certain amount.
## Supported data sources
Cr3dentials supports a wide range of data sources, including social platforms like YouTube, e-commerce stores like Shopify, payroll tools like Deel, accounting software, and more. If it starts with HTTPS, we can verify it.
Whether you're a lender, fintech platform, or credit scoring provider, Cr3dentials helps you onboard and underwrite digital workers with privacy, speed, and trust.
Cr3dentials never sees or stores sensitive data. All proofs are generated client-side using zero-knowledge cryptography. We never see or store user credentials.
This documentation walks you through using the [dashboard](https://app.cr3dentials.xyz), sending verification requests, and integrating the API. Questions? Reach us at [info@cr3dentials.xyz](mailto:info@cr3dentials.xyz).
# Supported Data Sources
Source: https://docs.cr3dentials.xyz/platforms/supported-data-sources
Platforms Cr3dentials can verify today, with coverage by data type.
If it starts with HTTPS, we can verify it.
The table below shows the platforms we support today and the coverage for each data type. Production means it runs against live accounts. Sandbox means it works in test environments. N/A means that data type does not apply to the platform.
| Platform | Category | Identity | Income | Activity | Employment |
| --------- | --------------- | ---------- | ---------- | ---------- | ---------- |
| Uber | Gig work | Production | Production | Production | N/A |
| Bolt | Gig work | Production | Production | Production | N/A |
| PrivyHome | Crypto | Production | Production | Production | Production |
| Deel | Payroll | Production | Production | Production | Production |
| Onlyfans | Social | Production | Production | Production | Production |
| Shopify | Commerce | Production | Production | Production | N/A |
| Youtube | Social | Sandbox | Sandbox | Sandbox | N/A |
| Binance | Crypto Exchange | Sandbox | Sandbox | Sandbox | N/A |
| Twitch | Social | Sandbox | Sandbox | Sandbox | N/A |
| Upwork | Freelancing | Sandbox | Sandbox | Sandbox | Sandbox |
| X | Social | Sandbox | Sandbox | Sandbox | Sandbox |
This list grows. If you need a platform that is not here yet, contact us at [info@cr3dentials.xyz](mailto:info@cr3dentials.xyz) and we will tell you where it stands.
# Contact Us
Source: https://docs.cr3dentials.xyz/resources/contact
How to reach the Cr3dentials team for access and support.
For partner account approval or support, email [info@cr3dentials.xyz](mailto:info@cr3dentials.xyz). We respond to access requests and integration questions directly.
Already have an account? Sign in at [app.cr3dentials.xyz](https://app.cr3dentials.xyz).
Set up your first verification and see a proof end to end.
Integrate Cr3dentials into your own underwriting workflow.
# FAQ
Source: https://docs.cr3dentials.xyz/resources/faq
Common questions about how Cr3dentials verifies income and activity.
Cr3dentials is a verification platform that helps you confidently underwrite creators, freelancers, and online earners by generating privacy-preserving proofs of income, activity, or engagement from any HTTPS-based platform.
The user securely logs into their platform account like YouTube, Upwork, or a bank. Cr3dentials captures key information directly from the page, like earnings or payouts, and generates it into a cryptographic proof, shared with you as a verifiable credential.
Our system ensures that the information was captured from a live, authenticated session from a real platform over a secure connection. It is like getting a notarized screenshot, only encrypted, private, and impossible to fake.
Cr3dentials does not rely on APIs or platform permissions. We can verify any HTTPS-based website, including those without official public APIs. This gives you access to long-tail platforms and global users who earn outside traditional systems.
Any HTTPS-based website. This includes YouTube, Shopify, Upwork, Fiverr, Patreon, OnlyFans, traditional banks, and more. View our supported data sources here: [Supported Data Sources](/platforms/supported-data-sources).
We can verify income history, payout amounts, job completion, engagement metrics, or any account data displayed on the page. You choose what matters for your underwriting.
Yes. Cr3dentials is designed to protect user privacy. We never store login credentials or raw data. All verifications are cryptographic, user-consented, and privacy-preserving by default.
You get reliable, real-time signals on borrower income and activity without waiting for bank statements, PDFs, or API tokens. This lets you approve high-potential borrowers faster, even if they earn from unconventional platforms.
You can start with our dashboard for manual review or integrate our API for automated workflows. No technical lift is needed to get started.
Yes. Our system can support both one-time verifications and continuous updates, depending on your needs.
Screen-scraping requires storing user credentials and automatically logging into their accounts, often without their active involvement. Cr3dentials is fully user-initiated and never stores credentials. Users generate cryptographic proofs directly from their data, ensuring privacy, control, and security.
# System Architecture
Source: https://docs.cr3dentials.xyz/security/architecture
How Cr3dentials verifies credentials with zero-knowledge proofs and cryptographic attestations without storing or accessing sensitive data.
Cr3dentials is a privacy-first credential verification platform. It uses zero-knowledge proofs and cryptographic attestations to verify credentials without storing or accessing sensitive user data.
The architecture is built so that we see nothing, store nothing, and know nothing about your private information while still producing cryptographically verifiable proofs.
## Privacy-First Design
### Core Privacy Principles
* **Cr3dentials never sees your credentials.** All verification happens through zero-knowledge proofs.
* **Zero access to sensitive data.** Our system only receives cryptographic proofs, not raw data.
* **You control what gets disclosed.** Choose exactly what to reveal and what to keep private.
### Zero-Knowledge Proof Integration
Our system verifies information without ever accessing the underlying data.
Zero-knowledge proofs are generated on your device.
We only receive mathematical proofs, never raw data.
Verifiable claims are created without exposing private information.
### Selective Disclosure Control
Cr3dentials gives you granular control over what to expose or hide.
Generate proofs that only confirm yes/no requirements.
* Example: "Income > \$50k" without revealing the exact amount.
* Bank account ownership without showing balance details.
Choose specific data points to reveal.
* Example: Show monthly income but hide account numbers.
* Reveal employment dates but keep the employer name private.
Optionally share complete verification details.
* Useful for full background checks.
* Still cryptographically secured and verifiable.
### Data Flow
The request is sent through encrypted channels.
Proof generation happens locally on the user's device.
Cr3dentials validates cryptographic proofs only.
Public, verifiable claims are created on blockchain.
Results are available without exposing private data.
### Privacy Technologies
**Zero-Knowledge Proofs**
* Mathematical privacy guarantees
* Cryptographic verification without data exposure
* Scalable proof systems
**Ethereum Attestation Service (EAS)**
* On-chain attestation creation
* Public verifiability
* Composable credential system
## Privacy Guarantees
### What We Never See
| Never Accessed | Never Stored |
| ----------------------- | -------------------------------- |
| Bank account numbers | Personal identifying information |
| Actual bank balances | Transaction histories |
| Social security numbers | Employment details |
| Credit scores | Healthcare records |
| Personal documents | Biometric data |
### What We Can Verify
| Verifiable Claims | Privacy Level |
| ----------------- | ------------------------ |
| Account ownership | Zero-knowledge proof |
| Income thresholds | Range verification |
| Employment status | Boolean confirmation |
| Age verification | Threshold proof |
| Identity claims | Cryptographic validation |
## Security Architecture
### Cryptographic Security
**Transport Security**
* TLS 1.3 encryption for all communications
* Certificate pinning for API endpoints
* Perfect forward secrecy
**Proof Security**
* zk-SNARKs for zero-knowledge proofs
* Digital signatures for authenticity
* Cryptographic hashing for integrity
**Blockchain Security**
* Ethereum network security
* Audited smart contracts
* Immutable attestation records
### Attack Resistance
| Threat | Defense |
| ----------------- | ------------------------------------------- |
| Privacy attacks | Prevented by zero-knowledge cryptography |
| Data breaches | Nothing to breach; no sensitive data stored |
| Man-in-the-middle | TLS encryption and certificate pinning |
| Replay attacks | Cryptographic nonces and timestamps |
| Impersonation | Digital signature verification required |
## Integration Guides
### Creating a Privacy-First Verification
```typescript theme={null}
// Example: Income Verification with Privacy Controls
const verification = await cr3dentials.createVerification({
type: 'income',
privacyLevel: 'threshold', // binary | threshold | selective | full
requirements: {
minIncome: 50000,
period: '3months'
},
disclosure: {
showAmount: false, // Only show yes/no
showSource: false, // Hide employer name
showPeriod: true // Show verification period
}
});
```
### Generating Zero-Knowledge Proofs
```typescript theme={null}
// User generates proof locally - Cr3dentials never sees raw data
const proof = await reclaim.generateIncomeProof({
requirements: verification.requirements,
privacyLevel: verification.privacyLevel
});
// Only cryptographic proof is sent to Cr3dentials
const attestation = await cr3dentials.submitProof(proof);
```
### API Endpoints
```http Authentication theme={null}
POST /auth/login
POST /auth/verify
GET /auth/me
```
```http Verification Sessions theme={null}
POST /verification/sessions/income
GET /verification/sessions/{id}
POST /verification/sessions/{id}/approve
POST /verification/sessions/{id}/reject
```
```http Proof Management theme={null}
POST /verification/initiate-verification
POST /verification/submit-verification
GET /verification/steps/{stepId}
```
## Compliance and Regulations
### GDPR Compliance
* **Right to be forgotten:** Users control all data; nothing is stored centrally.
* **Data minimization:** Only necessary proofs are processed.
* **Consent management:** Granular permission controls.
* **Data portability:** Users own all their proofs.
### Financial Regulations
* **Privacy protection:** No storage of financial account data.
* **AML compliance:** Verified attestations for anti-money laundering.
* **KYC requirements:** Identity verification without data retention.
* **Banking regulations:** Compliance with financial privacy laws.
## Monitoring and Observability
**Metrics collection** covers application metrics (request latency, error rates, throughput), privacy metrics (proof generation success rates, verification times), infrastructure metrics (CPU, memory, disk), and business metrics (verification completion rates, adoption).
**Logging** covers security logs, privacy logs (proof validation events with no sensitive data), error logs, and audit logs for verification requests and attestation creation.
Privacy logs record proof validation events only. They never contain sensitive data.
# Data Handling & Privacy
Source: https://docs.cr3dentials.xyz/security/data-handling
What Cr3dentials collects, what it never collects, and how zero-knowledge architecture protects your data end to end.
Cr3dentials runs on a privacy-by-design architecture. Protecting your sensitive information is the principle that shapes the platform, not a feature added on top.
This page is a full account of how we handle data: what we collect, what we don't, and how we protect your privacy.
## Core Privacy Philosophy
### Zero-Knowledge Architecture
Our system is built so that we cannot and do not access your sensitive personal information. This is a property of the architecture, not a policy choice.
**Key Principles**
* **Privacy by design:** Privacy protections are built into the technology, not added later.
* **Data minimization:** We collect only what verification requires.
* **User control:** You decide what to share and with whom.
* **Cryptographic guarantees:** Mathematical proofs ensure privacy, not just promises.
## What We Never Collect or See
### Financial Information
Cr3dentials never has access to your financial data.
| Never Collected | Why We Don't Need It |
| ----------------------- | ----------------------------------------------------------------- |
| Bank account numbers | Zero-knowledge proofs verify ownership without revealing accounts |
| Account balances | We verify threshold compliance, not exact amounts |
| Transaction histories | Pattern verification happens locally on your device |
| Credit card information | Not required for our verification process |
| Investment portfolios | Outside scope of current verification types |
| Credit scores | We verify creditworthiness claims, not scores themselves |
| Tax documents | Income verification through secure third-party proofs |
| Loan information | Not collected or needed for verification |
### Personal Identifiable Information (PII)
We operate without accessing traditional PII.
| Never Collected | Alternative Approach |
| ------------------------ | --------------------------------------------------- |
| Social Security Numbers | Identity verified through cryptographic proofs |
| Driver's license numbers | Age/identity verified without document access |
| Passport information | Citizenship claims verified through ZK proofs |
| Home addresses | Location verification without address disclosure |
| Birth dates | Age verification without revealing exact birth date |
| Phone numbers\* | Only collected if you choose it for communication |
| Biometric data | Never collected or processed |
| Government ID photos | Identity verified through other means |
Phone numbers are only collected if you explicitly provide them for account recovery or communication preferences.
### Employment and Professional Information
Your career details remain private.
| Never Collected | How We Verify Instead |
| -------------------- | --------------------------------------------------- |
| Salary amounts | Income threshold verification through ZK proofs |
| Employment contracts | Employment status verified through third parties |
| HR records | Professional claims verified without record access |
| Performance reviews | Skill attestations from colleagues/supervisors |
| Job titles | Professional credentials verified independently |
| Employer names\* | Employment verification without revealing employers |
| Start/end dates\* | Employment duration verified in ranges |
Employer names and employment dates may be disclosed at your discretion for specific verification types.
### Health and Medical Information
We never process health data.
| Never Collected | How We Verify Instead |
| ---------------------- | ------------------------------------------------- |
| Medical records | Health claims verified through ZK proofs |
| Insurance information | Coverage verification without policy details |
| Prescription data | Medical credentials without personal health info |
| Health test results | Compliance verification without result disclosure |
| Mental health records | Professional credentials only |
| Disability information | Accommodation verification without disclosure |
## What We Do Collect
### Account and Authentication Data
**Required for account creation**
* **Email address:** For account creation, recovery, and important notifications.
* Stored encrypted in our database.
* Used only for authentication and critical communications.
* Can be updated or removed when closing your account.
* **Wallet address:** For blockchain-based authentication.
* Public key only, never private keys.
* Used for Web3 authentication and attestation signing.
* A standard blockchain address, publicly visible by nature.
**Optional profile information**
* **Display name:** A user-chosen identifier for attestations. Can be pseudonymous or anonymous, and changeable at any time.
* **Communication preferences:** Email frequency settings and notification types (verification updates, security alerts). Modifiable in account settings.
### Verification Metadata
**Request information**
* **Verification type:** What kind of verification was requested (income, employment, etc.)
* **Requirements:** Threshold amounts, time periods, criteria (e.g., "income > \$50k")
* **Request timestamp:** When verification was initiated
* **Expiration date:** When the request expires
* **Status:** Current state (pending, completed, failed, expired)
**Proof validation data**
* **Cryptographic proof hashes:** Mathematical representations of proofs, not original data
* **Validation results:** Whether proofs passed or failed
* **Validation timestamp:** When validation occurred
* **Proof method:** Which method was used (direct attestation, etc.)
**Attestation references**
* **Attestation UIDs:** Unique identifiers for blockchain attestations
* **Schema information:** Structure of attestation data
* **Blockchain network:** Which network the attestation was created on
* **Public keys:** For attestation signature verification
### Technical and System Data
**API usage logs**
* Request timestamps, endpoint access, response codes
* IP addresses for security monitoring and fraud prevention
* User agent for browser/app compatibility
**Error and debugging logs**
* Error messages (never containing personal data)
* Stack traces (scrubbed of sensitive information)
* Performance metrics and anonymous, aggregated usage statistics
**Security monitoring**
* Login attempts (successful and failed)
* Suspicious activity and unusual access patterns
* Rate limiting for abuse prevention
* Audit trail of sensitive operations (without personal data)
## Data Processing Methods
### Zero-Knowledge Proof Processing
Raw credentials are processed on your device only. Zero-knowledge proofs are generated locally. Cr3dentials never receives raw data.
Only cryptographic proofs are sent to our servers. Proofs contain no personal information, and mathematical validation is possible without data access.
We validate proof authenticity and correctness against the requested criteria. We have no access to the underlying data used in the proof.
A pass/fail result is generated and an attestation is created with public claims only. Personal data is never included in the final attestation.
## Data Storage and Security
### Encryption Standards
**Data at rest**
* **AES-256 encryption:** All stored data is encrypted with industry-standard encryption.
* **Key rotation:** Encryption keys rotated every 90 days.
* **Separate key management:** Encryption keys stored separately from data.
* **Hardware security modules:** Keys protected by HSMs in production.
**Data in transit**
* **TLS 1.3:** Latest transport layer security for all communications.
* **Certificate pinning:** Prevents man-in-the-middle attacks.
* **Perfect forward secrecy:** Each session uses unique encryption keys.
* **End-to-end encryption:** Sensitive operations encrypted client-to-server.
## Data Sharing and Third-Party Access
### What We Never Share
* **Raw personal data:** Never shared, because we don't collect it.
* **Financial information:** Never accessed or shared.
* **Identity documents:** Never collected or shared.
* **Private communications:** User messages or personal interactions.
* **Location data:** Precise location is never collected.
* **Browsing history:** We don't track or share web activity.
### Limited Sharing Scenarios
**Authorized verification results**
* **Cryptographic proof results:** Shared only with parties you authorize.
* **Attestation references:** Public blockchain references that contain no personal data.
* **Verification status:** Pass/fail results for authorized verifiers.
* **Compliance claims:** Regulatory compliance status when required.
**Legal requirements**
* **Law enforcement requests:** Limited to proof metadata, never raw credentials.
* **Court orders:** Compliance with valid legal process.
* **Regulatory audits:** Anonymized data for compliance verification.
* **National security:** As required by law; we will fight overreach.
**Service providers**
* **Infrastructure partners:** Hosting, security, and monitoring (with strict DPAs).
* **Blockchain networks:** Public attestation data only.
* **Email service:** For account communications (encrypted).
* **Security services:** Threat detection and prevention (anonymized data).
### Third-Party Service Agreements
All service providers sign comprehensive Data Processing Agreements (DPAs) with strict limitations on data use and processing, regular compliance audits, and the right to terminate for privacy violations.
| Category | Providers | Data Shared |
| -------------- | ------------------------- | ------------------- |
| Infrastructure | AWS, Google Cloud | Encrypted data only |
| Security | Threat detection services | Anonymized logs |
| Communication | Email delivery services | Minimal data |
| Monitoring | Performance and uptime | No personal data |
## User Rights and Controls
### Data Access Rights
**View your data**
* **Account dashboard:** See all data we have about you.
* **Verification history:** Complete record of your verifications.
* **Attestation registry:** All attestations created for you.
* **Data export:** Download your data in JSON format.
**Data portability**
* Instant export of verification history and attestations.
* Standardized JSON format compatible with other systems.
* Proof metadata exportable for independent verification.
* Attestation references (blockchain UIDs) for public verification.
### Privacy Controls
**Verification privacy settings**
* **Disclosure level:** Choose how much to reveal per verification.
* **Verifier authorization:** Control who can request verifications from you.
* **Attestation visibility:** Public, private, or semi-private attestations.
* **Expiration settings:** Set automatic expiration for sensitive attestations.
**Communication controls**
* **Notification preferences:** Choose what communications you receive.
* **Contact methods:** Select preferred channels.
* **Marketing opt-out:** No marketing communications.
* **Emergency contacts:** Optional emergency notification settings.
### Account Management
**Profile controls**
* **Pseudonymous operation:** Use chosen names or identifiers.
* **Multiple identities:** Create separate verification identities.
* **Identity switching:** Switch between professional and personal identities.
* **Anonymous verification:** Option for completely anonymous attestations.
**Security settings**
* **Two-factor authentication:** Required for sensitive operations.
* **Login notifications:** Alerts for new device access.
* **Suspicious activity:** Automatic alerts for unusual account activity.
* **Session management:** View and terminate active sessions.