> ## Documentation Index
> Fetch the complete documentation index at: https://docs.didit.me/llms.txt
> Use this file to discover all available pages before exploring further.

# 生成 SDK 交易令牌 API：客户端 KYT 交易监控

> 生成短期有效的范围受限 token，让 Didit SDK 可以直接从您的应用提交受监控交易。主体绑定由服务端强制执行。



Mint SDK 交易 token API 提示词
        将提示词复制到剪贴板



      
      

\<pre>

\`Mint a short-lived scoped token that lets the Didit SDKs submit monitored transactions directly from an end-user's device.

Endpoint:
POST https://verification.didit.me/v3/transactions/sdk-token/

Authentication:
Use the x-api-key header with my Didit API key. This call runs on YOUR BACKEND only - the API key must never ship in an app. Only the returned sdk_token travels to the device.

Goal:
\- Get an sdk_token scoped to one end user (vendor_data). The app passes it to the SDK's submitTransaction method (or directly to POST /v1/transactions/ via the X-Transaction-Token header).
\- The token binds the subject identity server-side: every transaction submitted with it has its subject forced to the token's vendor_data, so a tampered client cannot submit on behalf of another user.

Request body (application/json):
\{
"vendor_data": "user-042",   // required - your internal id for the end user
"ttl_seconds": 900,          // optional - default 900 (15 min), max 86400 (24 h)
"max_uses": 3                // optional - max successful submissions; omit for unlimited within the TTL
}
camelCase aliases (vendorData, ttlSeconds, maxUses) are also accepted.

Example call:
curl -X POST "https://verification.didit.me/v3/transactions/sdk-token/" \
-H "x-api-key: YOUR_API_KEY" -H "Content-Type: application/json" \
-d '{"vendor_data":"user-042","ttl_seconds":900,"max_uses":3}'

What to read from the response:
\- sdk_token - hand this to your app; it authenticates POST /v1/transactions/ via the X-Transaction-Token header.
\- expires_at - ISO-8601 expiry; mint a fresh token per user session rather than reusing long-lived ones.

Failure modes:
\- 400 - missing vendor_data or invalid ttl_seconds/max_uses.
\- 401 - missing or malformed x-api-key.

Best practice:
\- Mint per user session, keep max_uses tight when the number of expected submissions is known.
\- A 401 from POST /v1/transactions/ whose detail contains the word "expired" means the token aged out - mint a new one and retry.

For the full client-side submission guide, see /transaction-monitoring/sdk-transaction-submission.`

\</pre>



      
      

粘贴到



## OpenAPI

````yaml zh/openapi-25.json POST /v3/transactions/sdk-token/
openapi: 3.0.0
info:
  version: 3.0.0
  title: Didit Verification API
  description: 身份证件验证 API。使用 x-api-key 请求头进行身份验证。
servers:
  - url: https://verification.didit.me
security: []
tags: []
paths:
  /v3/transactions/sdk-token/:
    post:
      tags:
        - Transactions
      summary: 生成 SDK 交易 token
      description: >-
        生成一个短期受限 token，您的应用可将其传递给 Didit SDK，以便直接通过 `POST /v1/transactions/`
        从终端用户的设备提交交易。该 token 与单个 `vendor_data`（您的用户 ID）绑定：使用该 token
        提交的每笔交易，其主体身份都会在服务端根据该绑定关系强制生效，从而防止被篡改的客户端代表其他用户提交交易。请仅从后端生成
        token，切勿在应用中直接包含 API
        密钥本身。接口同样支持驼峰命名别名（`vendorData`、`ttlSeconds`、`maxUses`）。
      operationId: createTransactionSdkToken
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                vendor_data:
                  type: string
                  description: 您为此 token 作用域所限定的终端用户的内部标识符。强制作为使用该 token 提交的每笔交易的主体身份。
                  example: user-042
                ttl_seconds:
                  type: integer
                  default: 900
                  maximum: 86400
                  description: token 生命周期，以秒为单位。默认为 900（15 分钟）；最大值为 86400（24 小时）。
                max_uses:
                  type: integer
                  nullable: true
                  description: 使用此 token 允许的最大成功提交次数。省略或设为 null 表示在 TTL 内不限使用次数。
              required:
                - vendor_data
            example:
              vendor_data: user-042
              ttl_seconds: 900
              max_uses: 3
      responses:
        '201':
          description: >-
            已签发的 token。将 `sdk_token` 传递给您的应用；它在 `expires_at` 之前通过
            `X-Transaction-Token` 请求头对面向设备的 `/v1/transactions/` endpoint 进行身份验证。
          content:
            application/json:
              schema:
                type: object
                properties:
                  sdk_token:
                    type: string
                    description: 要传递给 SDK 的作用域交易 token。
                  expires_at:
                    type: string
                    format: date-time
                    description: token 停止被接受的时间。
              example:
                sdk_token: q7Zt...urlsafe
                expires_at: '2026-07-07T12:15:00Z'
        '400':
          description: 验证失败：缺少 `vendor_data`，或 `ttl_seconds` 超出允许范围。
          content:
            application/json:
              examples:
                Missing vendor_data:
                  value:
                    vendor_data:
                      - This field is required.
        '403':
          description: 缺少、无效或已撤销的 API 密钥。
          content:
            application/json:
              examples:
                Invalid API Key:
                  value:
                    detail: Invalid API Key.
      security:
        - ApiKeyAuth: []
      x-codeSamples:
        - lang: curl
          label: curl
          source: >-
            curl -X POST
            https://verification.didit.me/v3/transactions/sdk-token/ \
              -H 'x-api-key: YOUR_API_KEY' -H 'Content-Type: application/json' \
              -d '{"vendor_data": "user-042", "ttl_seconds": 900, "max_uses": 3}'
        - lang: python
          label: Python
          source: |-
            from didit import Didit

            # Reads DIDIT_API_KEY.
            client = Didit()

            result = client.transactions.create_sdk_token(
                vendor_data="user-042",
                ttl_seconds=900,
                max_uses=3,
            )
            print(result)
        - lang: javascript
          label: Node.js
          source: |-
            import Didit from "@didit-protocol/sdk-node";

            // Reads DIDIT_API_KEY.
            const didit = new Didit();

            const result = await didit.transactions.createSdkToken({
              vendor_data: "user-042",
              ttl_seconds: 900,
              max_uses: 3,
            });
            console.log(result);
        - lang: go
          label: Go
          source: "ctx := context.Background()\n// Reads DIDIT_API_KEY.\nclient := didit.NewClient()\n\nresult, err := client.Transactions.CreateSDKToken(ctx, didit.TransactionsCreateSDKTokenParams{\n\tVendorData: \"user-042\",\n\tTTLSeconds: didit.Int(900),\n\tMaxUses:    didit.Int(3),\n})\nif err != nil {\n\tlog.Fatal(err)\n}\nfmt.Printf(\"%+v\\n\", result)"
        - lang: java
          label: Java
          source: >-
            import me.didit.Didit;

            import me.didit.types.TransactionsCreateSdkTokenParams;


            // Reads DIDIT_API_KEY.

            Didit client = new Didit();


            var result =
            client.transactions().createSdkToken(TransactionsCreateSdkTokenParams.builder()
                    .vendorData("user-042")
                    .ttlSeconds(900L)
                    .maxUses(3L)
                    .build());
            System.out.println(result);
        - lang: php
          label: PHP
          source: |-
            <?php

            require 'vendor/autoload.php';

            use Didit\DiditClient;

            // Reads DIDIT_API_KEY.
            $didit = new DiditClient();

            $result = $didit->transactions->createSdkToken([
                'vendor_data' => 'user-042',
                'ttl_seconds' => 900,
                'max_uses' => 3,
            ]);
            print_r($result->toArray());
        - lang: ruby
          label: Ruby
          source: |-
            require "didit"

            # Reads DIDIT_API_KEY.
            didit = Didit::Client.new

            result = didit.transactions.create_sdk_token(
              vendor_data: "user-042",
              ttl_seconds: 900,
              max_uses: 3
            )
            puts result.to_h
        - lang: csharp
          label: .NET
          source: >-
            using System;

            using System.Text.Json;

            using Didit;


            // Reads DIDIT_API_KEY.

            using var client = new DiditClient();


            var result = await client.Transactions.CreateSdkTokenAsync(new
            TransactionsCreateSdkTokenParams

            {
                VendorData = "user-042",
                TtlSeconds = 900,
                MaxUses = 3,
            });

            Console.WriteLine(JsonSerializer.Serialize(result));
components:
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key
      description: >-
        您的应用 API 密钥，可在 Business Console 的“开发者 -> API
        密钥”中获取。主密钥拥有完整访问权限。指定名称的密钥可设置作用域：针对每个资源设为无权限、只读或读写，限定于特定工作流或已通过的会话、限定于
        IP 地址列表，以及设置到期日期。401 表示密钥错误、已撤销或已过期；403 表示未发送密钥、密钥无权访问该资源或操作，或请求来自其 IP
        列表之外的地址；在会话路由上返回 404 表示该会话不在该密钥允许的工作流或状态范围内。没有媒体访问权限的密钥获取到的图片、视频和 PDF
        URL 将为 null；没有会话写入权限的密钥获取到的会话链接和 token 将为 null。请参阅
        https://docs.didit.me/console/api-keys。

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.