> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vu-one.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Quickstart: your first identity verification
> Who VU is, what Identity Link is for, and two ways to run your first identity verification: from the app without writing code, or through the API.
VU is a Latin American digital identity and fraud prevention company. For nearly two decades it has built the identity layer behind banks, telcos, retailers and government agencies across the region — today protecting more than 350 million users across 170 organizations.
**VU Identity Link is the self-serve front door to that stack.** Document capture, OCR, certified liveness and anti-spoofing — the same engine VU deploys as enterprise projects — packaged as one thing you can start using on your own this afternoon: you create a single-use link, you send it to a person, they verify themselves in the browser they already have, and the result comes back to you. No integration project, no sales call, nothing for your customer to install.
**There are two ways in, and you do not have to choose one forever.** Track A runs entirely from the app and works on the free Basic plan. Track B is the API, which needs Premium or Pro. Most teams start with Track A to see a real verification, then move to Track B.
## Track A — Verify someone today, without writing code
Sign up at [identity.vu-one.com/signup](https://identity.vu-one.com/signup). New accounts start on **Basic**: 10 verifications a month, no credit card.
Go to **Settings → Your business** and set the business name your customer will see on the verification screens. On Basic that is the one branding control you get; logo and color unlock on Premium.
Open **Verifications** and click **Create link**. Choose the full flow — document plus liveness — and copy the URL you get back. It looks like this:
```text theme={null}
https://identity.vu-one.com/validationprocess?link=550e8400-e29b-41d4-a716-446655440000
```
Send the URL however you already reach that person: email, WhatsApp, SMS, or a QR code. They open it in their browser, photograph the front and back of their ID, and complete the liveness check.
You are sharing a link, not their documents. The captures travel inside the link's own session, straight to VU. On Basic the link stops working 30 minutes after you created it, and it is single-use either way — once someone completes it, it is spent.
The verification moves from the **Active** tab to **Verified**. Open its card and click **Customer's data** to see the fields read from the document.
On Basic that data stays readable for **60 minutes** from creation — the 30-minute link window plus the 30-minute data window, which add up. After that the card stays listed as a record that the verification happened, but the data is gone.
What Basic does **not** include: API access, logo and color, expiration windows longer than 30 minutes, and precise customer location. [Plans](/en/identity-link/plans) sets out exactly what each tier changes.
## Track B — Integrate it into your product
**The API needs Premium or Pro.** On Basic, `POST /oauth/token` answers `401 invalid_client` with the message *"User must have Premium or Pro plan"*.
Open **Plans** in the app and subscribe to Premium — USD 49.99 a month, 100 verifications a month. For a custom quota, longer windows, or hosting outside the shared SaaS, [talk to us about Pro](https://www.vusecurity.com/contacto).
Go to **Settings → Developers**. You will find your **Client Id**, **Client Secret** and **Webhook Secret** there, plus the default **Callback Url** used when a verification finishes. **Refresh** rotates a credential when you need to.
The same values come back from `GET /users/me` on an authenticated call. Either way they belong in your backend, in a secrets manager — never in a mobile app or a frontend bundle.
Exchange the pair for a Bearer token, valid for 3600 seconds. The credentials travel Base64-encoded in an `Authorization: Basic` header.
```bash Request theme={null}
curl -X POST https://api.identity.vu-one.com/api/v1/oauth/token \
-H "Authorization: Basic $(printf '%s' "$CLIENT_ID:$CLIENT_SECRET" | base64)" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_credentials"
```
```json Response theme={null}
{
"access_token": "eyJhbGciOiJSUzI1NiIs...",
"expires_in": 3600,
"token_type": "Bearer"
}
```
`FULL FLOW` is document plus liveness; `ID ONLY` reads the document and stops there. `externalUserId` is your own identifier for the person — it is also what the [adaptive flow](/en/identity-link/introduction#adaptive-flow) uses later to recognise a returning customer.
```bash Request theme={null}
curl -X POST https://api.identity.vu-one.com/api/v1/links \
-H "Authorization: Bearer $ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"type": "FULL FLOW",
"externalUserId": "customer-12345",
"callbackUrl": "https://your-app.com/verification-done",
"metadata": {"campaign": "quickstart"}
}'
```
```json Response theme={null}
{
"linkId": "550e8400-e29b-41d4-a716-446655440000",
"linkUrl": "https://identity.vu-one.com/validationprocess?link=550e8400-e29b-41d4-a716-446655440000",
"verificationId": "6ba7b810-9dad-11d1-80b4-00c04fd430c8"
}
```
Send `linkUrl` to the person exactly as you would in Track A.
Two ways, and they are not exclusive. Register an endpoint with `POST /webhook-endpoints` and VU posts every step as it happens:
```json theme={null}
{
"type": "verification.successful",
"data": {
"_verificationId": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
"_externalUserId": "customer-12345",
"_metadata": { "campaign": "quickstart" }
}
}
```
Check the `X-Signature-SHA256` header against your `webhookSecret` before you trust it — see [Webhooks](/en/identity-link/webhooks). Or poll the public status endpoint, which needs no token:
```bash theme={null}
curl "https://api.identity.vu-one.com/api/v1/verifications/$VERIFICATION_ID/status?linkId=$LINK_ID"
```
Either way, the document fields themselves come from an authenticated `GET /verifications/{id}`. [KYC](/en/identity-link/kyc) lists every field it returns.
Read the result while the window is open. Past the verification's `expiresAt`, `GET /verifications/{id}` answers `410` and its images answer `404`, whatever your plan — the window is the sum of your link and data expiration settings.
## Where to go next
What Basic, Premium and Pro each change: quota, expiration windows, branding, location precision and hosting.
Token lifecycle, credential rotation, and where the secrets belong.
Every field of a link, the adaptive flow, and the full lifecycle from creation to expiry.
The twelve events, the payload shape, and how to verify the signature.
## Related topics
- [Identity Link plans](/en/identity-link/plans.md)
- [Identity Link Webhooks: Verification Lifecycle Events](/en/identity-link/webhooks.md)
- [Authenticate with OAuth2 Client Credentials](/en/identity-link/authentication.md)
- [VU Cloud Services](/en/vucs/introduction.md)
- [Identity Link API Changelog](/en/identity-link/changelog.md)
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.