Developers

One API. Every product.

KYC comes first, then a sponsored account, then bind and unlock. Your API key stays on your own server: the browser or mobile app talks to your backend, and your backend talks to us. Works with WharfKit wallet sessions and with passkeys.

const baseUrl = process.env.BOUND_IDENTITY_URL!;
const apiKey = process.env.BOUND_IDENTITY_API_KEY!; // server-side only

async function identityFetch(path, init) {
  const res = await fetch(baseUrl + path, {
    ...init,
    headers: {
      Authorization: "Bearer " + apiKey,
      Accept: "application/json",
      "Content-Type": "application/json",
      ...init?.headers,
    },
  });
  const body = await res.json();
  if (!res.ok) throw new Error(body.message || "HTTP " + res.status);
  return body;
}

// 1. Verify the person first — no chain account yet (default organization policy).
const { personDid, verificationUrl } = await identityFetch("/v1/kyc/start", {
  method: "POST",
  body: JSON.stringify({}),
});
// … open verificationUrl from your KYC provider …

// 2. When approved, take the one-time create token.
const { kycCreateToken } = await identityFetch(
  "/v1/kyc/status?personDid=" + encodeURIComponent(personDid),
);

// 3. Sponsor the provisional account. Token replay is rejected.
const { accountDid } = await identityFetch("/v1/accounts/free", {
  method: "POST",
  body: JSON.stringify({
    ownerPublicKey,
    personDid,
    kycCreateToken,
    // Production also requires emailProofToken + phoneProofToken
  }),
});

// 4. Bind the approved person to this account: the user signs once.
const { payloadToSign, message } = await identityFetch("/v1/bind/challenge", {
  method: "POST",
  body: JSON.stringify({ accountDid, personDid }),
});
await identityFetch("/v1/bind/confirm", {
  method: "POST",
  body: JSON.stringify({
    accountDid,
    personDid,
    nonce: message.nonce,
    signature, // WharfKit / passkey over payloadToSign
  }),
});

// 5. Lift faucet limits. Done.
await identityFetch("/v1/accounts/unlock", {
  method: "POST",
  body: JSON.stringify({ accountDid }),
});

No identity document ever passes through your code, and no secret ever reaches the browser. Default organizations refuse free account creation until KYC is approved. Integrate against the sandbox at sandbox.identityinc.io, free test verifications, simulated chain, then move production traffic to Builder or Growth.