> ## Documentation Index
> Fetch the complete documentation index at: https://guides.saber.money/llms.txt
> Use this file to discover all available pages before exploring further.

# KYC Widget

> Integrating the Saber Money KYC Widget: HMAC-SHA256 signature generation, redirect URL parameters, and region-specific Indian and non-Indian verification flows.

The Saber KYC Widget guides your users through KYC verification tailored to their service and region. After registering a user, redirect them to the widget to complete it.

Note: for merchants still on the Onramp SDK (deprecated), KYC can also trigger automatically on the user's first transaction.

## Steps for KYC Web Widget

**Prerequisite:** Create the user with a valid phone and email.

### Step 1: Generate the signature (secret) for the Widget

A unique secret is required for every session.

```javascript theme={null}
// Variables (these should be securely stored and handled)
var clientId = 'YOUR_CLIENT_ID'; // Replace with your actual client ID
var clientSecret = 'YOUR_CLIENT_SECRET'; // Replace with your actual client secret
var user_id = 'USER_ID'; // Replace with the user's ID received when creating the user in Step 2

// Step 1: Generate timestamp
var timestamp = Math.floor(Date.now() / 1000).toString();

// Step 2: Create the signature string
var sigString = clientId + timestamp + "sdk" + user_id;

// Step 3: Generate the HMAC-SHA256 signature
var secret = CryptoJS.HmacSHA256(sigString, clientSecret).toString().toUpperCase();

// The 'secret' can now be used to authenticate the SDK request
```

### Step 2: Generate redirect URL

Pass these query parameters on the base URL:

| Query parameter      | Description                                                                                                                      |
| -------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| `API Key(client_id)` | Provided by Saber                                                                                                                |
| `user_id`            | Generated when creating the user                                                                                                 |
| `timestamp`          | The timestamp used when creating the secret                                                                                      |
| `signature(secret)`  | The secret generated in Step 1                                                                                                   |
| `redirect_url`       | *Optional.* Where the user is sent once the KYC flow finishes. Must be URL-encoded and appended as the **last** query parameter. |

**Base URL**

| Environment | Link                                                                       |
| ----------- | -------------------------------------------------------------------------- |
| Production  | [https://app.saber.money/kyc](https://app.saber.money/kyc)                 |
| Sandbox     | [https://app.sandbox.saber.money/kyc](https://app.sandbox.saber.money/kyc) |

**Example**

```text theme={null}
https://app.sandbox.saber.money/kyc?client_id=d951b040-ecb0-432b-ae3c-2ae7d2d19987&user_id=d951b040-ecb0-432b-ae3c-2ae7d2d1998&timestamp=1687276964&secret=CE1B5BD087BA408C2AFF01B00595007858DF496D3468CE3307CB1A7966DDC265
```

> 📘
>
> The URL is valid for **10 minutes** from when the secret is created.

### Step 3: Redirect your user to the link

#### Returning the user to your app

To bring the user back into your own app once they exit the KYC flow, append `redirect_url` as the last query parameter:

```text theme={null}
?redirect_url=<url-encoded-url>
```

Full example:

```text theme={null}
https://app.sandbox.saber.money/kyc?client_id=d951b040-ecb0-432b-ae3c-2ae7d2d19987&user_id=d951b040-ecb0-432b-ae3c-2ae7d2d1998&timestamp=1687276964&secret=CE1B5BD087BA408C2AFF01B00595007858DF496D3468CE3307CB1A7966DDC265&redirect_url=https%3A%2F%2Fyourapp.com%2Fkyc%2Fcomplete
```

<Note>
  The value must be URL-encoded, otherwise its own query string is parsed as part of the widget URL. If `redirect_url` is omitted, the user stays on the Saber-hosted page after finishing.
</Note>

<Warning>
  A redirect only signals that the user left the flow — it is not a confirmation that KYC passed. Always confirm the outcome from the [KYC status webhook](/user/kyc/webhooks) or by fetching the user.
</Warning>

## KYC Flows

The flow is chosen automatically from the phone country ID passed at user creation.

### Indian KYC

* **Personal information**
* **PAN verification**
* **Aadhaar verification** — via Digilocker
* **Live selfie**
* **Bank account verification** (optional, penny-drop — can be disabled per merchant)

### Indian KYC (Passport)

Used where PAN verification isn't required:

* **Personal information**
* **Passport verification** — in place of PAN
* **Live selfie**
* **Bank account verification** (optional, same as above)

### Non-Indian KYC

* **Country-specific steps** — ID, address verification, and other local requirements.
* **Selfie and bank verification** — included where locally mandated or configured.

KYC Widget can't be used for USD Onramp — see [KYC Partner URL](/user/kyc/partner-url).


## Related topics

- [Overview](/user/kyc/overview.md)
- [EUR/GBP Onramp](/onramp/currencies/eur-gbp.md)
- [BDT Offramp](/offramp/currencies/bdt.md)
- [EUR/GBP Offramp](/offramp/currencies/eur-gbp.md)
- [IDR Offramp](/offramp/currencies/idr.md)