Skip to main content

WIDTH Identity Developer Documentation

WIDTH Identity provides a complete identity verification and compliance platform supporting KYC, KYB, transaction screening, and continuous monitoring workflows — accessible via REST APIs and drop-in SDKs for web, iOS, and Android.

Capabilities

The platform exposes four primary compliance workflows. Each is available via the REST API and most are available via the SDKs.

Integration paths

Three primary integration methods. Use OpenAPI for full backend control, or the SDKs for a managed verification UX.

PathBest forWorkflows
OpenAPI (REST, server-to-server) You already collect customer data and want full backend control over UX. KYC, KYB, Transaction Screening, Continuous Monitoring
Mobile SDK (Android, iOS) Turnkey verification experience in a mobile app with minimal code. KYC, KYB
Web SDK Drop-in modal or new-tab verification in a web app. KYC, KYB, One-off liveness
Tip. Most teams use the SDK for end-user verification and the OpenAPI for backend operations (transaction screening, monitoring, decisions). The two work together — both write to the same workflow engine and share the same audit trail.

Environments

Two environments: staging for development and production for live traffic. All staging URLs end in -stg.

ResourceStagingProduction
API Gatewayhttps://one-gateway-api-stg.width.com/gatewayhttps://one-gateway-api.width.com/gateway
Storage Servicehttps://one-gateway-api-stg.width.com/storagehttps://one-gateway-api.width.com/storage
Platform Consolehttps://one-platform-stg.width.comhttps://one-platform.width.com

Credentials

Two credential types depending on integration path.

TypeUsed byFields
OPENAPIServer-to-server APIapiKey (prefixed ak_) + apiSecret (prefixed sk_)
SDKWeb / Mobile SDKappId + apiKey + per-session sdkToken

How to obtain

  1. Log in to the One Platform Console → API & Integration.
  2. Click Generate to mint a key pair.
  3. Copy and store credentials securely. The apiSecret is shown only once.
Never hard-code apiSecret in source code. Use environment variables or a secrets manager. If a secret leaks, rotate it immediately from the console.

Quick start — signing a request

Every OpenAPI request is signed with HMAC-SHA256 over the request body. The signature is appended as the sign query parameter.

sign = HmacSHA256(apiSecret, requestBody)

Both the key and body use UTF-8 encoding. The result is a 64-character lowercase hex string.

import hmac, hashlib

sign = hmac.new(
    api_secret.encode('utf-8'),
    request_body.encode('utf-8'),
    hashlib.sha256
).hexdigest()
const crypto = require('crypto');

const sign = crypto
  .createHmac('sha256', apiSecret)
  .update(requestBody, 'utf8')
  .digest('hex');
Mac mac = Mac.getInstance("HmacSHA256");
mac.init(new SecretKeySpec(apiSecret.getBytes("UTF-8"), "HmacSHA256"));
byte[] hash = mac.doFinal(requestBody.getBytes("UTF-8"));
String sign = HexFormat.of().formatHex(hash);

See the authentication reference for the full request envelope, including headers, query parameters, and a worked example.

Next: pick a workflow