🔎User KYC Verification APIs

The User Verification APIs allow merchants to create and update end users, submit identity and address documents, perform AML screening, and initiate a liveness-verification session.

The APIs are designed for server-to-server integration and must only be called from the merchant’s secure backend.

Available Operations

Operation	Endpoint	Purpose
Create or update user	POST /common/initiateUser	Insert a new user or update the user’s basic profile information
Update proof of identity	POST /common/initiateKyc	Submit the user’s identity-document images
Update proof of address	POST /common/initiateKyc	Submit the user’s proof-of-address document
Run AML screening	POST /common/initiateKyc	Screen the user against applicable AML data sources
Initiate liveness verification	POST /common/initiateKyc	Generate a liveness-verification link for the user

---

Authentication

Every request must include the following headers:

Content-Type: application/json
x-tlp-apikey: <merchant-api-key>
x-tlp-signature: <hmac-signature>

The merchant API secret must remain confidential and must never be exposed in:

• Browser applications

• Mobile applications

• Public repositories

• Client-side JavaScript

• Logs

• Analytics platforms

• Published documentation

Generating the Signature

The signature is generated by applying HMAC-SHA256 to the exact JSON request body:

HMAC_SHA256(merchantApiSecret, JSON.stringify(requestBody))

Example:

const crypto = require("crypto");

const rawPayload = JSON.stringify(requestBody);

const signature = crypto
  .createHmac("sha256", process.env.TYLT_API_SECRET)
  .update(rawPayload)
  .digest("hex");

The body sent to Tylt must be exactly the same body used to generate the signature.

Changes to any of the following after signing may cause authentication to fail:

• Field order

• Field names

• Field values

• Data types

• Nested object structure

• Whitespace, where the raw serialized payload differs

---

Base URL

Development

https://api.tylt.money/