Onboarding

Step-by-step creator onboarding. Only creator accounts register this way; agencies register through Agency accounts.

The Fangate web app runs these steps in this order. A partner product may run them from screens of its own - see the last section - but every step stays: the creator confirms the e-mail address, signs the contract and passes the identity check with Fangate.

---

Step 1: E-mail address and confirmation mail

The creator enters an e-mail address; the client sends the confirmation mail.

API: POST /api/user/email/verify

{
  "email": "creator@example.com",
  "invite_code": "ab12c",   // optional, a referrer's 5-character code
  "return_url": "https://app.example.com/fangate/confirmed"   // partners only, see below
}

The address must not belong to an existing account and must not be a disposable address. Rate limit: 3 a minute per address, 10 a minute per IP.

---

Step 2: The click (required)

The creator opens the link in the mail. That click is what confirms the address; nothing else does. The client can wait for it:

API: GET /api/registration/email-status?email=creator@example.com

{ "success": true, "data": { "confirmed": true, "expired": false } }

Poll every 3 to 5 seconds until confirmed is true (an address nobody asked a mail for answers confirmed: false as well). Rate limit: 30 a minute per address and endpoint, 300 a minute per IP shared by both status endpoints. Without the click, POST /api/register answers 422 with errors_code: email_not_confirmed.

48 hours. A confirmation mail and the click on it are valid for 48 hours from the moment the mail was sent. After that the link in the mail shows "expired", an earlier click no longer counts for POST /api/register, and the status answers expired: true - stop polling and let the creator request a new mail with POST /api/user/email/verify. A new mail for an address whose click is still valid changes nothing; once the click has expired, a new mail starts a fresh 48 hours and the creator opens the link once more.

---

Step 3: Currency

The creator chooses the payout currency (USD, EUR or GBP). It is a permanent account setting.

API: currency_id on POST /api/register (the ids come from GET /api/app-data).

---

Step 4: Account information

Field	Required	Notes
First name, last name	Yes
Birth date	Yes	YYYY-MM-DD, 18+
Password	Yes
Referral code	No	invite_code, a referrer's 5-character code
Address	No	Max. 255 characters; required only when payout details are sent with the registration
Payout info	No	Not asked at sign-up since 2026-09-27; the creator adds the payout account under Payout settings before the first cashout. bank_data is still accepted, see Users
Legal acceptance	Yes	registration_legal_accepted: true (Terms of Service, Privacy Policy, Content Removal Policy, 18 USC 2257 statement; GET /api/app-data lists the documents under registration.legal.documents)
Display consent	Recommended	content_display_consent: true, a checkbox of its own; wording in GET /api/app-data → registration.content_display_consent.label. Required only while registration.content_display_consent.required is true (currently not in production); when sent, it must be true

API: POST /api/register with the full payload, see Auth.

---

Step 5: Signature

The creator signs the creator contract in Fangate's signature form (Jotform). Embed the form - GET /api/app-data carries its address under registration.signature (form_url, prefill_url_template, iframe_id) - with the creator's e-mail prefilled: the signature is matched to the registration by that address. Then wait for it:

API: GET /api/registration/signature-status?email=creator@example.com

{ "success": true, "data": { "ready": true, "provider": "jotform", "signed_at": "2026-09-25T09:41:12+00:00" } }

Poll every few seconds until ready is true (same rate limit as the e-mail status). A signature is used once: after the registration it belongs to, a new registration with the same address needs a new one.

---

Step 6: Register

API: POST /api/register with the fields of steps 3 and 4 plus email.

The response carries the user and a login token. Refusals: email_not_confirmed (step 2 missing), a missing or already used signature (step 5), a taken or disposable address, an age under 18.

---

Step 7: Identity verification (before the first upload)

1. GET /api/veriff/create - a Veriff session; open its url for the creator. From your product: with the creator's API key (Manage content); for an account that never had a session the call always answers with one. Register your webhook for account.verified / account.verification_declined with the same key first, so the result reaches you.
2. The creator completes the check on Veriff's page.
3. Fangate hears the decision from Veriff. You hear it through the webhooks account.verified / account.verification_declined, or by polling POST /api/veriff/decision.
4. Uploads and products are open (is_verified).

An upload before that answers 422 creator_verification_required. See Verification.

---

Summary

E-mail → click on the confirmation mail → currency + account data → signature
     → POST /api/register → Veriff → uploads open

---

Registration from your own screens

A CRM or vault may run the steps above from its own screens. Everything is called by the creator's browser or by your server as documented; the creator enters the data, Fangate keeps every check. Things to know:

• The click lands where you say. Send return_url with POST /api/user/email/verify and the click on the mailed link ends on that page, with ?email=<address>&email_confirmed=1 appended. Only https pages on a domain you have registered with us (mail to info@fangate.app); any other address is refused with 422. Without return_url the click leads to the Fangate web app. Your page then confirms the state with GET /api/registration/email-status - the redirect alone is not the proof.
• The signature form is Jotform's, embedded in your page with the e-mail prefilled; Fangate fetches the signed submission from Jotform itself.
• Your page has to be registered with us. POST /api/register, POST /api/login and POST /api/agencies/register answer the Fangate apps and registered partner pages only; any other page is refused with 403 origin_not_allowed. Send us the origins of your pages (https://app.example.com) - see What we need from you. A server of yours that calls these endpoints without a page origin has to be registered by its IP address the same way.
• The password stays with the creator. POST /api/register needs a password, so call it - and the key creation right after - from the creator's browser, not through your server; then neither the password nor the login token ever passes through your systems. If your screens run server-side, treat the password as in transit only: send it once, never store it.
• The login token from POST /api/register lets the same page create the API key for your product at once (POST /api/user/api-keys, see API Keys; 10 a minute per login and IP). It expires 4 hours after it was issued to a partner page or server - do not keep it, work with the API key.
• Limits from one server: POST /api/register is held to 5 a minute per address and IP and 15 a minute per IP; the confirmation mail to 3 per address and 10 per IP; the two status polls to 30 per address each and 300 per IP together. Registered partner servers get 100 mails and 600 polls a minute per IP - the registration and key-creation limits are per address and stay. Ask by mail to info@fangate.app.

The order of calls for a new creator, in one list:

1. POST /api/user/email/verify (no token) - the confirmation mail, with your return_url.
2. GET /api/registration/email-status (no token) - poll every 3 to 5 seconds until confirmed: true.
3. Embed the signature form; GET /api/registration/signature-status (no token) - poll until ready: true.
4. POST /api/register (no token) - the account; the answer carries a login token.
5. POST /api/user/api-keys (login token) - the creator's key for your product, with the permissions the creator ticks. Then drop the login token.
6. POST /api/webhooks (API key) - one webhook for this creator, with the events you need (account.verified, account.verification_declined, payment.successful, ...).
7. GET /api/veriff/create (API key) - the first Veriff session; open its url for the creator. The verdict arrives on the webhook.

Everything after that - uploads, products, sales - runs with the key as described in Vault for integrations.

Payout details can be sent with the registration; changing them later is done by the creator in the Fangate dashboard.