Quickstart: your first identity verification

VU is a Latin American digital identity and fraud prevention company. For nearly two decades it has built the identity layer behind banks, telcos, retailers and government agencies across the region — today protecting more than 350 million users across 170 organizations. VU Identity Link is the self-serve front door to that stack. Document capture, OCR, certified liveness and anti-spoofing — the same engine VU deploys as enterprise projects — packaged as one thing you can start using on your own this afternoon: you create a single-use link, you send it to a person, they verify themselves in the browser they already have, and the result comes back to you. No integration project, no sales call, nothing for your customer to install.

There are two ways in, and you do not have to choose one forever. Track A runs entirely from the app and works on the free Basic plan. Track B is the API, which needs Premium or Pro. Most teams start with Track A to see a real verification, then move to Track B.

Track A — Verify someone today, without writing code

Create your account

Make it yours

Go to Settings → Your business and set the business name your customer will see on the verification screens. On Basic that is the one branding control you get; logo and color unlock on Premium.

Create a link

Open Verifications and click Create link. Choose the full flow — document plus liveness — and copy the URL you get back. It looks like this:

https://identity.vu-one.com/validationprocess?link=550e8400-e29b-41d4-a716-446655440000

Share it

Send the URL however you already reach that person: email, WhatsApp, SMS, or a QR code. They open it in their browser, photograph the front and back of their ID, and complete the liveness check.You are sharing a link, not their documents. The captures travel inside the link’s own session, straight to VU. On Basic the link stops working 30 minutes after you created it, and it is single-use either way — once someone completes it, it is spent.

Read the result

The verification moves from the Active tab to Verified. Open its card and click Customer’s data to see the fields read from the document.On Basic that data stays readable for 60 minutes from creation — the 30-minute link window plus the 30-minute data window, which add up. After that the card stays listed as a record that the verification happened, but the data is gone.

What Basic does not include: API access, logo and color, expiration windows longer than 30 minutes, and precise customer location. Plans sets out exactly what each tier changes.

Track B — Integrate it into your product

The API needs Premium or Pro. On Basic, POST /oauth/token answers 401 invalid_client with the message “User must have Premium or Pro plan”.

Upgrade

Open Plans in the app and subscribe to Premium — USD 49.99 a month, 100 verifications a month. For a custom quota, longer windows, or hosting outside the shared SaaS, talk to us about Pro.

Get your credentials

Go to Settings → Developers. You will find your Client Id, Client Secret and Webhook Secret there, plus the default Callback Url used when a verification finishes. Refresh rotates a credential when you need to.The same values come back from GET /users/me on an authenticated call. Either way they belong in your backend, in a secrets manager — never in a mobile app or a frontend bundle.

Get a token

Exchange the pair for a Bearer token, valid for 3600 seconds. The credentials travel Base64-encoded in an Authorization: Basic header.

curl -X POST https://api.identity.vu-one.com/api/v1/oauth/token \
  -H "Authorization: Basic $(printf '%s' "$CLIENT_ID:$CLIENT_SECRET" | base64)" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials"

{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "expires_in": 3600,
  "token_type": "Bearer"
}

Create a link

FULL FLOW is document plus liveness; ID ONLY reads the document and stops there. externalUserId is your own identifier for the person — it is also what the adaptive flow uses later to recognise a returning customer.

curl -X POST https://api.identity.vu-one.com/api/v1/links \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "FULL FLOW",
    "externalUserId": "customer-12345",
    "callbackUrl": "https://your-app.com/verification-done",
    "metadata": {"campaign": "quickstart"}
  }'

{
  "linkId": "550e8400-e29b-41d4-a716-446655440000",
  "linkUrl": "https://identity.vu-one.com/validationprocess?link=550e8400-e29b-41d4-a716-446655440000",
  "verificationId": "6ba7b810-9dad-11d1-80b4-00c04fd430c8"
}

Send linkUrl to the person exactly as you would in Track A.

Get the result

Two ways, and they are not exclusive. Register an endpoint with POST /webhook-endpoints and VU posts every step as it happens:

{
  "type": "verification.successful",
  "data": {
    "_verificationId": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
    "_externalUserId": "customer-12345",
    "_metadata": { "campaign": "quickstart" }
  }
}

Check the X-Signature-SHA256 header against your webhookSecret before you trust it — see Webhooks. Or poll the public status endpoint, which needs no token:

curl "https://api.identity.vu-one.com/api/v1/verifications/$VERIFICATION_ID/status?linkId=$LINK_ID"

Either way, the document fields themselves come from an authenticated GET /verifications/{id}. KYC lists every field it returns.

Read the result while the window is open. Past the verification’s expiresAt, GET /verifications/{id} answers 410 and its images answer 404, whatever your plan — the window is the sum of your link and data expiration settings.

Where to go next

Plans

What Basic, Premium and Pro each change: quota, expiration windows, branding, location precision and hosting.

Authentication

Token lifecycle, credential rotation, and where the secrets belong.

Links

Every field of a link, the adaptive flow, and the full lifecycle from creation to expiry.

Webhooks

The twelve events, the payload shape, and how to verify the signature.

​Track A — Verify someone today, without writing code

​Track B — Integrate it into your product

​Where to go next

Plans

Authentication

Links

Webhooks

Track A — Verify someone today, without writing code

Track B — Integrate it into your product

Where to go next