Verification

Identity and age-verification flows used by Fangate.

Two systems are active:

• Veriff: creator identity verification
• Yoti: buyer age verification

They solve different problems and should not be treated as interchangeable.

---

Veriff

Veriff is used for creator identity verification.

GET /api/veriff/create

Create a new Veriff session for the authenticated creator. The response carries the hosted Veriff url; open it for the creator in your own product or send it to them - the decision reaches Fangate directly from Veriff, and you hear it through the account.verified / account.verification_declined webhooks.

• Auth required: Yes
• Roles: Authenticated creator (login token), or a generated API key with Manage content
• Rate limit: 5 a minute per account

API keys. Every session is billed and replaces the account's current one, so a program gets a session only when the account is not verified and its last session ended with a final negative verdict (declined, expired, abandoned, or a session Veriff no longer knows) or it never had one. While a session is still under review the call answers 409 with errors_code: verification_pending - this answer is free, no session is opened; a verified account answers 409 already_verified. One session is opened at a time per account; a second call while the first is still with Veriff also answers verification_pending.

Open a session after account.verification_declined with decision: declined or underage, not on a schedule. resubmission_requested is not final: the creator can submit again in the session they already have, so the call answers verification_pending until that session is decided or expires. If a creator never starts a session, wait for it to expire (Veriff closes unused sessions after seven days).

Success response example

Current controller returns the raw Veriff session payload, not the standard Fangate { success, data } wrapper.

{
  "status": "success",
  "verification": {
    "id": "96972fba-3de6-4346-9029-4fdbea684bd3",
    "url": "https://alchemy.veriff.com/v/...",
    "vendorData": "42",
    "host": "https://alchemy.veriff.com",
    "status": "created",
    "sessionToken": "jwt-token"
  }
}

Error example

"Can't create session"

Side effects

• on success, backend stores veriff_id on the user

---

POST /api/veriff/decision

Fetch the current verification decision for the authenticated creator.

• Auth required: Yes
• Roles: Authenticated creator (login token), or any generated API key (it reads products, so it may read this)
• Rate limit: 30 a minute per account

Success response examples

Verified:

[
  "User is verified"
]

Not verified:

[
  "User is not verified"
]

Missing session:

"The user hasn't verification session."

Important notes

• this endpoint also does not use the standard Fangate response wrapper
• when Veriff decision code 9001 is returned, backend updates is_verified=true

---

Yoti

Yoti is used for buyer age verification when a product requires it.

POST /api/yoti/session/create

Create a Yoti age-verification session.

• Auth required: No
• Roles: Public buyer flow
• Content type: application/json

Request body

Field	Type	Required	Notes
short_link_key	string	Yes	Product short-link key used to build the return URL.

Success response example

{
  "success": true,
  "session_id": "abc-123-def",
  "link": "https://api.yoti.com/..."
}

Error example

{
  "success": false,
  "message": "Failed to create verification session",
  "error": null
}

Important notes

• current controller does not wrap this in the standard API envelope
• Yoti session creation uses the current PHP session id plus the short-link return target

---

Verification flow examples

Creator identity verification

1. GET /api/veriff/create
2. creator completes hosted Veriff flow
3. POST /api/veriff/decision
4. GET /api/user confirms is_verified

Buyer age verification

1. buyer opens a sales link for adult content with age check enabled
2. frontend calls POST /api/yoti/session/create
3. buyer completes the age-verification flow
4. the provider reports the result to Fangate
5. buyer returns to purchase flow

---

Related

• Auth
• Consent & Adult Content