API v1

Verify users in three API calls

Trustable lets you confirm someone is a real, verified adult without ever receiving their documents, name, or date of birth. You get a short-lived signed proof token with only the claims your app requested.

Create a business account Open token inspector

Authentication

Create an API key in the dashboard, then pass it as a Bearer token. Keys are hashed at rest and shown only once.

Authorization: Bearer tk_test_...

1. Create a verification request

Your backend asks Trustable for a consent link, specifying the claims you need and why.

POST /api/v1/verification-requests
Authorization: Bearer tk_test_...
Content-Type: application/json

{
  "application_id": "app_...",
  "claims": ["verified_person", "age_over_18"],
  "purpose": "Confirm you are a real adult person to join",
  "token_ttl_seconds": 300
}

201 Created

{
  "id": "req_...",
  "status": "pending",
  "authorize_url": "https://your-app/authorize/req_...",
  "requested_claims": ["verified_person", "age_over_18"],
  "expires_at": "2026-07-27T13:00:00.000Z"
}

2. Send the user to the consent screen

The user sees exactly which claims you requested — and what will never be shared — then approves or denies. On approval, Trustable issues a short-lived JWT proof token bound to your application.

// Redirect or link the user to:
window.location.href = authorize_url

// After approval the user (or your redirect handler)
// receives the proof token. Tokens expire in <= 5 minutes.

3. Verify the proof token

Verify signature, expiry, audience, and revocation server-side before trusting any claim.

POST /api/v1/tokens/verify
Authorization: Bearer tk_test_...
Content-Type: application/json

{
  "token": "eyJhbGciOiJIUzI1NiIs...",
  "application_id": "app_..."
}

200 OK

{
  "valid": true,
  "errors": [],
  "subject": "trust_9f2ac...",   // pairwise pseudonym, unique per app
  "claims": {
    "verified_person": true,
    "age_over_18": true,
    "iss": "https://trustable.demo",
    "aud": "app_...",
    "exp": 1774612345
  }
}

Polling request status

GET /api/v1/verification-requests/req_...
Authorization: Bearer tk_test_...

// status: "pending" | "approved" | "denied" | "expired"

Supported claims

Only these claims can be requested, and each one requires the user's explicit approval. Personal data like legal name and date of birth is shared only when requested and consented to. Raw documents, selfies, and biometrics are never available through the API.

verified_personVerified person
age_over_18Over 18
countryCountry of residence
verification_levelVerification level
verified_atVerification date
unique_accountOne account per platform
full_nameLegal name
birth_dateDate of birth

Webhooks

Configure endpoints in the dashboard for authorization.approved, authorization.denied, and credential.revoked events. Deliveries are simulated in this demo.

{
  "event": "authorization.approved",
  "request_id": "req_...",
  "status": "approved",
  "claims": ["verified_person", "age_over_18"]
}