> For the complete documentation index, see [llms.txt](https://docs.tylt.money/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tylt.money/tylt-crossramp-fiat-crypto-solutions/user-kyc-verification-apis.md).

# User KYC Verification APIs

The User Verification APIs allow merchants to create and update end users, submit identity and address documents, perform AML screening, and initiate a liveness-verification session.

The APIs are designed for server-to-server integration and must only be called from the merchant’s secure backend.

### Available Operations

| Operation                      | Endpoint                    | Purpose                                                          |
| ------------------------------ | --------------------------- | ---------------------------------------------------------------- |
| Create or update user          | `POST /common/initiateUser` | Insert a new user or update the user’s basic profile information |
| Update proof of identity       | `POST /common/initiateKyc`  | Submit the user’s identity-document images                       |
| Update proof of address        | `POST /common/initiateKyc`  | Submit the user’s proof-of-address document                      |
| Run AML screening              | `POST /common/initiateKyc`  | Screen the user against applicable AML data sources              |
| Initiate liveness verification | `POST /common/initiateKyc`  | Generate a liveness-verification link for the user               |

***

## Authentication

Every request must include the following headers:

```http
Content-Type: application/json
x-tlp-apikey: <merchant-api-key>
x-tlp-signature: <hmac-signature>
```

The merchant API secret must remain confidential and must never be exposed in:

* Browser applications
* Mobile applications
* Public repositories
* Client-side JavaScript
* Logs
* Analytics platforms
* Published documentation

### Generating the Signature

The signature is generated by applying HMAC-SHA256 to the exact JSON request body:

```
HMAC_SHA256(merchantApiSecret, JSON.stringify(requestBody))
```

Example:

```javascript
const crypto = require("crypto");

const rawPayload = JSON.stringify(requestBody);

const signature = crypto
  .createHmac("sha256", process.env.TYLT_API_SECRET)
  .update(rawPayload)
  .digest("hex");
```

The body sent to Tylt must be exactly the same body used to generate the signature.

Changes to any of the following after signing may cause authentication to fail:

* Field order
* Field names
* Field values
* Data types
* Nested object structure
* Whitespace, where the raw serialized payload differs

***

## Base URL

### Development

```json
https://api.tylt.money/
```