Skip to main content

Quick Start

Integration in 3 steps. You need your Trusty credentials (public_token and webhook_secret).

1. Embed the widget​

<script src="https://trusty.sh/trusty-widget.js"></script>
<trusty-verify
  public-token="TR_PUB_xxx"
  metadata='{"userId":"123"}'
  lang="en">
</trusty-verify>

Option B: Iframe​

<iframe
  src="https://trusty.sh/verify?public_token=TR_PUB_xxx&lang=en&metadata=%7B%22userId%22%3A%22123%22%7D"
  style="width:100%;max-width:420px;height:640px;border:0"
  allow="camera">
</iframe>

2. Receive the webhook​

When the verification completes, Trusty sends a POST to your endpoint:

{
  "event": "kyc.verification.completed",
  "verification_id": "601e510f-...",
  "status": "approved",
  "failure_reason": null,
  "data": {
    "document": { "full_name": "...", "document_number": "..." },
    "liveness": { "face_visible": true },
    "face_match": { "same_person": true, "confidence": "high" }
  },
  "metadata": { "userId": "123" },
  "completed_at": "2026-07-24T03:17:05.799Z"
}

Verify the HMAC-SHA256 signature in the X-Trusty-Signature header:

import { createHmac, timingSafeEqual } from 'node:crypto'

const expected = createHmac('sha256', process.env.TRUSTY_WEBHOOK_SECRET)
  .update(rawBody)
  .digest('hex')

const valid = timingSafeEqual(
  Buffer.from(signatureHeader),  // X-Trusty-Signature
  Buffer.from(`sha256=${expected}`)
)

3. Query verifications (optional)​

You can search past verifications with your webhook_secret:

curl "https://trusty-api.trusty.sh/api/v1/public/kyc/verifications?status=approved&limit=10" \
  -H "Authorization: Bearer TR_WHS_xxx"

See Lookup API for more details.

Done. Your user has been verified.