Triggering Limit Upgrade and EDD

The Saber EDD Web Widget guides users through enhanced due diligence for higher transaction limits and advanced features, once they’ve completed initial KYC. Requirements vary by geography and merchant configuration — Saber sets these up per merchant. The widget uses HMAC-based authentication: generate a unique signature on your backend for each session, so your API secret never leaves your server.

Integration Steps

Prerequisite

Create the User: Ensure the user is initialised in the Saber system with proper phone, email, and has completed basic KYC verification.

Step 1: Generate the HMAC Signature

A unique signature must be generated dynamically on your secure server backend for each user session:

// Variables (these should be securely stored on your server)
var clientId = 'YOUR_CLIENT_ID'; // Replace with your actual client ID  
var clientSecret = 'YOUR_CLIENT_SECRET'; // Replace with your actual client secret
var user_id = 'USER_ID'; // Replace with the user's ID from Saber system

// Step 1: Generate timestamp
var timestamp = Math.floor(Date.now() / 1000).toString();

// Step 2: Create the signature string
var sigString = clientId + timestamp + "sdk" + user_id;

// Step 3: Generate the HMAC-SHA256 signature
var signature = CryptoJS.HmacSHA256(sigString, clientSecret).toString().toUpperCase();

// The 'signature' can now be used to authenticate the EDD Widget request

Step 2: Generate Redirect URL

Once the signature is created for the user, compile the redirect link with the following query parameters:

Query Parameter	Description
`client_id` (or `api_key`)	Provided by Saber
`user_id`	The user’s UUID from the Saber system
`timestamp`	The timestamp used when creating the signature
`signature` (or `secret`)	The HMAC signature generated in step 1
`redirect_url` (optional)	URL to redirect user after EDD completion. If not provided, user will see the status screen

Base URLs:

Environment	URL
Production	`https://edd.saber.money`
Sandbox	`https://edd.sandbox.saber.money`

Example URLs: With redirect URL (user will be redirected after completion):

https://edd.sandbox.saber.money?client_id=d951b040-ecb0-432b-ae3c-2ae7d2d19987&user_id=d951b040-ecb0-432b-ae3c-2ae7d1998&timestamp=1687276964&signature=CE1B5BD087BA408C2AFF01B00595007858DF496D3468CE3307CB1A7966DDC265&redirect_url=https://yourapp.com/success

Without a redirect URL (user will see a Saber status screen after completion):

https://edd.sandbox.saber.money?client_id=d951b040-ecb0-432b-ae3c-2ae7d2d19987&user_id=d951b040-ecb0-432b-ae3c-2ae7d1998&timestamp=1687276964&signature=CE1B5BD087BA408C2AFF01B00595007858DF496D3468CE3307CB1A7966DDC265

Once the URL is generated, redirect your user to the link. The user will see the EDD form interface. Post-Completion Behaviour:

With redirect_url: After successful EDD completion, the user will be automatically redirected to the specified URL after 10 seconds.
Without redirect_url: After completion, the user will remain in the widget and see the EDD status screen showing their verification status.

Integration Options

Option 1: Direct Redirect

Redirect the user directly to the EDD Widget URL in the same browser tab:

window.location.href = eddWidgetUrl;

Option 2: Iframe Integration (Recommended)

Embed the EDD Widget as an iframe inside your page for a seamless user experience:

<iframe 
    src="https://edd.saber.money?client_id=YOUR_CLIENT_ID&user_id=USER_ID&timestamp=TIMESTAMP&signature=SIGNATURE"
    width="100%" 
    height="800px" 
    frameborder="0"
    style="border-radius: 8px;">
</iframe>

📘 For iframe integration, it is recommended to omit the redirect_url parameter so users see the status screen inside the iframe rather than being redirected away from your application.

Option 3: WebView Integration (Mobile Apps)

For React Native or native mobile apps, use a standard WebView component:

import { WebView } from 'react-native-webview';

<WebView 
    source={{ uri: eddWidgetUrl }}
    style={{ flex: 1 }}
    onMessage={handleMessage}
/>

EDD Status Flow

The EDD Widget supports the following status states:

Status	Description
`UNINITIATED`	EDD process not started
`INITIATED`	User has started the EDD process
`RESUBMISSION_REQUESTED`	Additional information required
`VERIFICATION_IN_PROGRESS`	EDD under review
`APPROVED`	EDD approved - user can access higher limits
`REJECTED`	EDD rejected - user cannot proceed

Security Considerations

URL Expiration

⚠️ Warning: The URL validity is 10 minutes from the creation of the signature. Always generate URLs dynamically in real-time just before redirecting users.

CORS and Origin Validation

The widget validates the origin of incoming requests. Ensure your web domain is correctly registered and whitelisted with Saber Money for iframe integrations.

HTTPS Required

All integrations must use HTTPS securely in production environments.

Error Handling

Common Error Scenarios

Invalid Signature: Check timestamp validity and signature generation logic.
Expired URL: Generate a fresh signature.
User Not Found: Ensure user is created and exists in the Saber system.
Insufficient Permissions: Verify user has completed basic KYC.

Event Timing

close: Fired when the user clicks the close button or navigates away from the widget.
completed: Fired when the user successfully submits all required EDD information.
error: Fired when validation fails, API errors occur, or other issues prevent EDD completion.
token_expired: Fired when the HMAC signature expires (10-minute validity window).

Event Handling Best Practices

Always Verify Origin: Check that events come from the correct Saber Money domain.
Handle All Events: Implement handlers for all four event types to provide a smooth user experience.
Token Expiration: For token_expired, automatically generate a new signature and reload the widget.
Error Recovery: For error events, provide clear messaging and retry options when appropriate.
User Feedback: Show appropriate loading states, success messages, and error notifications.
Graceful Closure: Handle close events by returning users to a logical point in your application flow.

Getting Started

Client Admin Operations

Offramp

Onramp

User Operations

Integration Steps

Prerequisite

Step 1: Generate the HMAC Signature

Step 2: Generate Redirect URL

Step 3: Redirect User to the Widget

Integration Options

Option 1: Direct Redirect

Option 2: Iframe Integration (Recommended)

Option 3: WebView Integration (Mobile Apps)

EDD Status Flow

Security Considerations

URL Expiration

CORS and Origin Validation

HTTPS Required

Error Handling

Common Error Scenarios

Event Timing

Event Handling Best Practices

​Integration Steps

​Prerequisite

​Step 1: Generate the HMAC Signature

​Step 2: Generate Redirect URL

​Step 3: Redirect User to the Widget

​Integration Options

​Option 1: Direct Redirect

​Option 2: Iframe Integration (Recommended)

​Option 3: WebView Integration (Mobile Apps)

​EDD Status Flow

​Security Considerations

​URL Expiration

​CORS and Origin Validation

​HTTPS Required

​Error Handling

​Common Error Scenarios

​Event Timing

​Event Handling Best Practices

Integration Steps

Prerequisite

Step 1: Generate the HMAC Signature

Step 2: Generate Redirect URL

Step 3: Redirect User to the Widget

Integration Options

Option 1: Direct Redirect

Option 2: Iframe Integration (Recommended)

Option 3: WebView Integration (Mobile Apps)

EDD Status Flow

Security Considerations

URL Expiration

CORS and Origin Validation

HTTPS Required

Error Handling

Common Error Scenarios

Event Timing

Event Handling Best Practices