Get Started
Integrate / SDKs
User Verification
Business Verification
Transaction Monitoring
Changelogcurl
curl -X POST 'https://verification.didit.me/v3/events/sdk-token/' \
-H 'x-api-key: YOUR_API_KEY' \
-H 'Content-Type: application/json' \
-d '{
"vendor_data": "user-42",
"allowed_event_categories": ["auth", "session", "gameplay"],
"ttl_seconds": 900,
"max_uses": 1000,
"bind_to_origin": "https://app.example.com"
}'import os
import requests
resp = requests.post(
'https://verification.didit.me/v3/events/sdk-token/',
headers={'x-api-key': os.environ['DIDIT_API_KEY']},
json={
'vendor_data': 'user-42',
'allowed_event_categories': ['auth', 'session', 'gameplay'],
'ttl_seconds': 900,
'max_uses': 1000,
'bind_to_origin': 'https://app.example.com',
},
timeout=10,
)
resp.raise_for_status()
credential = resp.json()
# Hand only monitoring_token to the app, never the API key.
print(credential['monitoring_token'], credential['expires_at'])const resp = await fetch('https://verification.didit.me/v3/events/sdk-token/', {
method: 'POST',
headers: {
'x-api-key': process.env.DIDIT_API_KEY,
'Content-Type': 'application/json',
},
body: JSON.stringify({
vendor_data: 'user-42',
allowed_event_categories: ['auth', 'session', 'gameplay'],
ttl_seconds: 900,
max_uses: 1000,
bind_to_origin: 'https://app.example.com',
}),
});
if (!resp.ok) throw new Error(await resp.text());
const { monitoring_token, expires_at } = await resp.json();
// Hand only monitoring_token to the app, never the API key.
console.log(monitoring_token, expires_at);<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://verification.didit.me/v3/events/sdk-token/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'vendor_data' => 'user-42',
'allowed_event_categories' => [
'auth',
'session',
'gameplay'
],
'ttl_seconds' => 900,
'max_uses' => 1000,
'bind_to_origin' => 'https://app.example.com'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://verification.didit.me/v3/events/sdk-token/"
payload := strings.NewReader("{\n \"vendor_data\": \"user-42\",\n \"allowed_event_categories\": [\n \"auth\",\n \"session\",\n \"gameplay\"\n ],\n \"ttl_seconds\": 900,\n \"max_uses\": 1000,\n \"bind_to_origin\": \"https://app.example.com\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://verification.didit.me/v3/events/sdk-token/")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"vendor_data\": \"user-42\",\n \"allowed_event_categories\": [\n \"auth\",\n \"session\",\n \"gameplay\"\n ],\n \"ttl_seconds\": 900,\n \"max_uses\": 1000,\n \"bind_to_origin\": \"https://app.example.com\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://verification.didit.me/v3/events/sdk-token/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"vendor_data\": \"user-42\",\n \"allowed_event_categories\": [\n \"auth\",\n \"session\",\n \"gameplay\"\n ],\n \"ttl_seconds\": 900,\n \"max_uses\": 1000,\n \"bind_to_origin\": \"https://app.example.com\"\n}"
response = http.request(request)
puts response.read_body{
"monitoring_token": "q7ZtR2xKp9VbN4mWc8LdH1sYfJ3gT6uEaQ0oPiXzBkC",
"expires_at": "2026-10-17T09:30:02.481000Z",
"allowed_event_categories": [
"auth",
"session",
"gameplay"
],
"max_uses": 1000,
"bind_to_origin": "https://app.example.com"
}Monitoring Events
Mint Monitoring SDK Token
Mint a short-lived device credential bound to one subject so your app can submit monitoring events without exposing your API key.
POST
/
v3
/
events
/
sdk-token
/
curl
curl -X POST 'https://verification.didit.me/v3/events/sdk-token/' \
-H 'x-api-key: YOUR_API_KEY' \
-H 'Content-Type: application/json' \
-d '{
"vendor_data": "user-42",
"allowed_event_categories": ["auth", "session", "gameplay"],
"ttl_seconds": 900,
"max_uses": 1000,
"bind_to_origin": "https://app.example.com"
}'import os
import requests
resp = requests.post(
'https://verification.didit.me/v3/events/sdk-token/',
headers={'x-api-key': os.environ['DIDIT_API_KEY']},
json={
'vendor_data': 'user-42',
'allowed_event_categories': ['auth', 'session', 'gameplay'],
'ttl_seconds': 900,
'max_uses': 1000,
'bind_to_origin': 'https://app.example.com',
},
timeout=10,
)
resp.raise_for_status()
credential = resp.json()
# Hand only monitoring_token to the app, never the API key.
print(credential['monitoring_token'], credential['expires_at'])const resp = await fetch('https://verification.didit.me/v3/events/sdk-token/', {
method: 'POST',
headers: {
'x-api-key': process.env.DIDIT_API_KEY,
'Content-Type': 'application/json',
},
body: JSON.stringify({
vendor_data: 'user-42',
allowed_event_categories: ['auth', 'session', 'gameplay'],
ttl_seconds: 900,
max_uses: 1000,
bind_to_origin: 'https://app.example.com',
}),
});
if (!resp.ok) throw new Error(await resp.text());
const { monitoring_token, expires_at } = await resp.json();
// Hand only monitoring_token to the app, never the API key.
console.log(monitoring_token, expires_at);<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://verification.didit.me/v3/events/sdk-token/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'vendor_data' => 'user-42',
'allowed_event_categories' => [
'auth',
'session',
'gameplay'
],
'ttl_seconds' => 900,
'max_uses' => 1000,
'bind_to_origin' => 'https://app.example.com'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://verification.didit.me/v3/events/sdk-token/"
payload := strings.NewReader("{\n \"vendor_data\": \"user-42\",\n \"allowed_event_categories\": [\n \"auth\",\n \"session\",\n \"gameplay\"\n ],\n \"ttl_seconds\": 900,\n \"max_uses\": 1000,\n \"bind_to_origin\": \"https://app.example.com\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://verification.didit.me/v3/events/sdk-token/")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"vendor_data\": \"user-42\",\n \"allowed_event_categories\": [\n \"auth\",\n \"session\",\n \"gameplay\"\n ],\n \"ttl_seconds\": 900,\n \"max_uses\": 1000,\n \"bind_to_origin\": \"https://app.example.com\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://verification.didit.me/v3/events/sdk-token/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"vendor_data\": \"user-42\",\n \"allowed_event_categories\": [\n \"auth\",\n \"session\",\n \"gameplay\"\n ],\n \"ttl_seconds\": 900,\n \"max_uses\": 1000,\n \"bind_to_origin\": \"https://app.example.com\"\n}"
response = http.request(request)
puts response.read_body{
"monitoring_token": "q7ZtR2xKp9VbN4mWc8LdH1sYfJ3gT6uEaQ0oPiXzBkC",
"expires_at": "2026-10-17T09:30:02.481000Z",
"allowed_event_categories": [
"auth",
"session",
"gameplay"
],
"max_uses": 1000,
"bind_to_origin": "https://app.example.com"
}
The credential is consumed by the device lane, described in SDK event submission, which also lists what the server enforces on every device request and which events are safe to drop under backpressure.
Authorizations
Your application's API key, from Developers -> API keys in the Business Console. The primary key has full access. A named key can be scoped: none, read or write per resource, limited to some workflows or to approved sessions, to a list of IP addresses, and to an expiry date. 401 means the key is missing, wrong, revoked or expired; 403 means the key has no access to this resource or action, or the request came from an address outside its IP list; 404 on a session route means the session is outside the key's workflows or statuses. A key without media access receives image, video and PDF URLs as null, and a key without sessions write receives session links and tokens as null. See https://docs.didit.me/console/api-keys.
Body
application/json
camelCase aliases are accepted: vendorData, entityType, allowedEventCategories, ttlSeconds, maxUses, bindToOrigin.
Your id for the subject every event submitted with this credential belongs to.
Required string length:
1 - 255company binds a company subject; any other value (default individual) binds an individual.
Maximum string length:
32Categories the credential may submit. Omit it or send [] to allow every category.
Available options:
auth, session, gameplay, bonus, affiliate, payment, dispute, security, responsible_gambling, custom Lifetime of the credential in seconds.
Required range:
60 <= x <= 86400Number of events the credential may submit (a batch spends one use per event). Send null for no cap within the lifetime.
Required range:
x >= 1When set, the browser Origin header of every device request must equal this value exactly; a request without Origin is refused.
Maximum string length:
255Response
The credential was minted. Hand monitoring_token to the app and treat it as a secret until expires_at.
The device credential (a 43-character URL-safe token). Send it in the X-Monitoring-Token header.
When the credential stops being accepted.
Categories the credential may submit; [] means every category.
Available options:
auth, session, gameplay, bonus, affiliate, payment, dispute, security, responsible_gambling, custom Event budget of the credential; null means no cap.
Origin the credential is bound to, or null.