White-label onboarding

SET API and SET Merchant API · Live since 2026-11-09

A page you frame in your own app where your customer completes KYB or KYC: SET's verification form, in your colours. It sits between the provider's hosted link (no design control) and KYB by API (you handle every document).

You never handle the details

The customer's details and documents go from the page to SET and on to SET's provider in the same request. You never see them, and SET stores none of them.

Set it up once

POST /v1/onboarding_settings:

• frameAncestors: up to 10 https origins that may frame the page, such as https://app.example.com, with no paths or wildcards. Until you set one, the page opens on its own but cannot be framed.
• colors: {accent, background, text} as 6-digit hex. Button text is black or white by contrast. You can also pass ?accent=&background=&text= per view.

For each customer

1. POST /v1/onboarding_sessions {externalId, type: "business" | "individual", expiresInHours?} returns the page's url. It is shown once and expires after 1–168 hours (default 24). A new session replaces any open link for that customer.
2. Frame the url. The customer goes through three steps:
   • the terms, opened in a new tab;
   • the form, with one optional document for a business (up to 4 MB);
   • the status, from which a business can send further documents.
3. Follow onboarding_session.submitted (session, customer and status; never the details), then customer.updated as verification moves.

GET /v1/onboarding_sessions/{id} shows state (open, submitted, canceled, expired) and whether the terms were accepted. POST /v1/onboarding_sessions/{id}/cancel stops the link.

Security

• The page runs no script.
• It can be framed only by your origins.
• Its form can post only to SET, and posts must come from SET's own origin.
• Anyone holding the url can fill the form for that customer, so treat it as a secret.

Limits

A person's identity document is not taken on the page. requirementsDue on the customer lists what is still needed.

A merchant key can verify only its own business.