Verify buttons

Start from a button

Creates a session from a verify button with a publishable key.

POST /api/embed/v1/buttons/{button_id}/sessions

Starts a verification from a web page, using your publishable key instead of a secret one. The verify button calls this when it's clicked. Call it yourself to build your own button.

link Path

button_id string path required

The button's ID, starting vb_. Its settings, such as its redirect_url, apply to the session.

link Body

publishable_key string required

Your publishable key, starting pk_live_, or pk_sandbox_ for a simulated verification (see Sandbox).

client_reference_id string

Your reference for the customer, up to 200 characters. Leave it out and we make one up, starting web-.

link Response

start_url string

Send the visitor here to verify. Works once, for 24 hours.

link Allowed websites

The browser sends the page's origin with the request. If the button has a list of allowed websites, requests from anywhere else are refused with 403. Responses carry CORS headers for allowed origins, so you can call this from your pages.

link Errors

StatusCodeWhen
403AUTHORIZATION_ERRORWrong publishable key, or a website the button doesn't allow
404NOT_FOUNDNo such button, or it's switched off
429RATE_LIMIT_ERRORMore than 10 a minute, or 60 an hour, from one visitor
JavaScript
const response = await fetch(
  "https://www.kaywhysee.com/api/embed/v1/buttons/vb_MP1rKDG8nqK_SmwO/sessions",
  {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      publishable_key: "pk_live_...",
      client_reference_id: "user_1042",
    }),
  },
);
const { start_url } = await response.json();
window.location.href = start_url;
cURL
curl -X POST https://www.kaywhysee.com/api/embed/v1/buttons/vb_MP1rKDG8nqK_SmwO/sessions \
  -H "Content-Type: application/json" \
  -H "Origin: https://shop.example" \
  -d '{"publishable_key": "pk_live_...", "client_reference_id": "user_1042"}'
201
{
  "start_url": "https://www.kaywhysee.com/s/ub3ehdgP2yJ1LPew0tYcrXtUssy6KVLp9LlBeHzE5Gs"
}
403
{
  "error": {
    "code": "AUTHORIZATION_ERROR",
    "message": "This button's publishable key doesn't match. Copy the snippet again."
  }
}
Was this page helpful?

Authorization

Your secret key stays in this tab: it is sent with this request only and never stored.

Body application/json

Response

Send the request to see the response.