# Quick start

Your backend creates a session, the person verifies on the hosted page, and you learn the result from a webhook and a signed result.

### 1. Create an API key

In Settings → API keys. A `sk_test_` key runs sandbox workflows, a `sk_live_` key production ones. Give each key only the access it needs (create sessions, read results, AML screening, read or change lists, each standalone check), and optionally the IP addresses it may be used from and an end date. Rotate a key to get a replacement while the old one keeps working for 24 hours. Keep keys on your server; never put them in a browser or app.

### 2. Create a session

```shell
curl -X POST https://api-verify.secuveri.com/v1/sessions \
  -H "x-api-key: $SECUVERI_API_KEY" \
  -H "content-type: application/json" \
  -H "Idempotency-Key: signup-1042" \
  -d '{
    "workflow_id": "<published workflow id>",
    "vendor_data": "customer-1042",
    "callback_url": "https://example.com/verified"
  }'
```

```shell
{
  "session_id": "6f1c2e0a-8f43-4f7e-9a51-2b7c1d9e4a10",
  "verification_id": "VRF-7KQ2M9XA",
  "status": "CREATED",
  "created_at": "2026-10-23T09:12:44.120Z",
  "session_token": "…",
  "url": "https://verify.secuveri.com/verification/VRF-7KQ2M9XA?t=…"
}
```

### 3. Send the person to the link

Redirect them to `url`, show it as a QR code, or let us send it: add `contact` and `send_link` (`email` or `sms`). On a computer, the page offers to continue on a phone. Store `verification_id` with your customer record.

### 4. Receive the webhook

Add an endpoint in Settings → Webhooks. Check every delivery's signature (see Webhooks) before you trust it.

### 5. Read the signed result

```shell
curl https://api-verify.secuveri.com/v1/verifications/VRF-7KQ2M9XA/result \
  -H "x-api-key: $SECUVERI_API_KEY"
```

The answer is a signed JWS you can keep as evidence. It holds the status, verdict, reason and the state of each check, never the person's personal data.