> ## Documentation Index
> Fetch the complete documentation index at: https://guides.saber.money/llms.txt
> Use this file to discover all available pages before exploring further.

# Triggering Limit Upgrade and EDD

> Integrate the Saber EDD Web Widget using HMAC-SHA256 signed redirect URLs, iframe or WebView, status states, and event handling.

The Saber EDD Web Widget guides users through enhanced due diligence for higher transaction limits and advanced features, once they've completed initial KYC. Requirements vary by geography and merchant configuration — Saber sets these up per merchant.

The widget uses HMAC-based authentication: generate a unique signature on your backend for each session, so your API secret never leaves your server.

## Integration Steps

### Prerequisite

**Create the User**: Ensure the user is initialised in the Saber system with proper phone, email, and has completed basic KYC verification.

### Step 1: Generate the HMAC Signature

A unique signature must be generated dynamically on your secure server backend for each user session:

```javascript theme={null}
// Variables (these should be securely stored on your server)
var clientId = 'YOUR_CLIENT_ID'; // Replace with your actual client ID  
var clientSecret = 'YOUR_CLIENT_SECRET'; // Replace with your actual client secret
var user_id = 'USER_ID'; // Replace with the user's ID from Saber system

// Step 1: Generate timestamp
var timestamp = Math.floor(Date.now() / 1000).toString();

// Step 2: Create the signature string
var sigString = clientId + timestamp + "sdk" + user_id;

// Step 3: Generate the HMAC-SHA256 signature
var signature = CryptoJS.HmacSHA256(sigString, clientSecret).toString().toUpperCase();

// The 'signature' can now be used to authenticate the EDD Widget request
```

### Step 2: Generate Redirect URL

Once the signature is created for the user, compile the redirect link with the following query parameters:

| Query Parameter            | Description                                                                                 |
| -------------------------- | ------------------------------------------------------------------------------------------- |
| `client_id` (or `api_key`) | Provided by Saber                                                                           |
| `user_id`                  | The user's UUID from the Saber system                                                       |
| `timestamp`                | The timestamp used when creating the signature                                              |
| `signature` (or `secret`)  | The HMAC signature generated in step 1                                                      |
| `redirect_url` (optional)  | URL to redirect user after EDD completion. If not provided, user will see the status screen |

**Base URLs:**

| Environment | URL                               |
| ----------- | --------------------------------- |
| Production  | `https://edd.saber.money`         |
| Sandbox     | `https://edd.sandbox.saber.money` |

**Example URLs:**

With redirect URL (user will be redirected after completion):

```text theme={null}
https://edd.sandbox.saber.money?client_id=d951b040-ecb0-432b-ae3c-2ae7d2d19987&user_id=d951b040-ecb0-432b-ae3c-2ae7d1998&timestamp=1687276964&signature=CE1B5BD087BA408C2AFF01B00595007858DF496D3468CE3307CB1A7966DDC265&redirect_url=https://yourapp.com/success
```

Without a redirect URL (user will see a Saber status screen after completion):

```text theme={null}
https://edd.sandbox.saber.money?client_id=d951b040-ecb0-432b-ae3c-2ae7d2d19987&user_id=d951b040-ecb0-432b-ae3c-2ae7d1998&timestamp=1687276964&signature=CE1B5BD087BA408C2AFF01B00595007858DF496D3468CE3307CB1A7966DDC265
```

### Step 3: Redirect User to the Widget

Once the URL is generated, redirect your user to the link. The user will see the EDD form interface.

**Post-Completion Behaviour:**

* **With `redirect_url`**: After successful EDD completion, the user will be automatically redirected to the specified URL after 10 seconds.
* **Without `redirect_url`**: After completion, the user will remain in the widget and see the EDD status screen showing their verification status.

## Integration Options

### Option 1: Direct Redirect

Redirect the user directly to the EDD Widget URL in the same browser tab:

```javascript theme={null}
window.location.href = eddWidgetUrl;
```

### Option 2: Iframe Integration (Recommended)

Embed the EDD Widget as an iframe inside your page for a seamless user experience:

```html theme={null}
<iframe 
    src="https://edd.saber.money?client_id=YOUR_CLIENT_ID&user_id=USER_ID&timestamp=TIMESTAMP&signature=SIGNATURE"
    width="100%" 
    height="800px" 
    frameborder="0"
    style="border-radius: 8px;">
</iframe>
```

> 📘 For iframe integration, it is recommended to omit the `redirect_url` parameter so users see the status screen inside the iframe rather than being redirected away from your application.

### Option 3: WebView Integration (Mobile Apps)

For React Native or native mobile apps, use a standard WebView component:

```javascript theme={null}
import { WebView } from 'react-native-webview';

<WebView 
    source={{ uri: eddWidgetUrl }}
    style={{ flex: 1 }}
    onMessage={handleMessage}
/>
```

## EDD Status Flow

The EDD Widget supports the following status states:

| Status                     | Description                                  |
| -------------------------- | -------------------------------------------- |
| `UNINITIATED`              | EDD process not started                      |
| `INITIATED`                | User has started the EDD process             |
| `RESUBMISSION_REQUESTED`   | Additional information required              |
| `VERIFICATION_IN_PROGRESS` | EDD under review                             |
| `APPROVED`                 | EDD approved - user can access higher limits |
| `REJECTED`                 | EDD rejected - user cannot proceed           |

## Security Considerations

### URL Expiration

> ⚠️ **Warning**: The URL validity is 10 minutes from the creation of the signature. Always generate URLs dynamically in real-time just before redirecting users.

### CORS and Origin Validation

The widget validates the origin of incoming requests. Ensure your web domain is correctly registered and whitelisted with Saber Money for iframe integrations.

### HTTPS Required

All integrations must use HTTPS securely in production environments.

## Error Handling

### Common Error Scenarios

1. **Invalid Signature**: Check timestamp validity and signature generation logic.
2. **Expired URL**: Generate a fresh signature.
3. **User Not Found**: Ensure user is created and exists in the Saber system.
4. **Insufficient Permissions**: Verify user has completed basic KYC.

### Event Timing

* **`close`**: Fired when the user clicks the close button or navigates away from the widget.
* **`completed`**: Fired when the user successfully submits all required EDD information.
* **`error`**: Fired when validation fails, API errors occur, or other issues prevent EDD completion.
* **`token_expired`**: Fired when the HMAC signature expires (10-minute validity window).

### Event Handling Best Practices

1. **Always Verify Origin**: Check that events come from the correct Saber Money domain.
2. **Handle All Events**: Implement handlers for all four event types to provide a smooth user experience.
3. **Token Expiration**: For `token_expired`, automatically generate a new signature and reload the widget.
4. **Error Recovery**: For `error` events, provide clear messaging and retry options when appropriate.
5. **User Feedback**: Show appropriate loading states, success messages, and error notifications.
6. **Graceful Closure**: Handle `close` events by returning users to a logical point in your application flow.


## Related topics

- [User Limits and EDD](/user/limits-edd.md)
- [EUR/GBP Onramp](/onramp/currencies/eur-gbp.md)
- [BDT Offramp](/offramp/currencies/bdt.md)
- [EUR/GBP Offramp](/offramp/currencies/eur-gbp.md)
- [IDR Offramp](/offramp/currencies/idr.md)