When you send emails from our platform, your applicants will receive a link to our WebSDK. In the WebSDK settings, you can provide a redirect URL that will change the link domain and generate a jwt (JSON Web Token) query parameter to verify the link.

To use this functionality, you need to initialize the WebSDK for a dynamic URL with a jwt query parameter and its confirmed value. The JWT value contains externalUserId (userId) and clientId, which defines a particular applicant on our platform. This will allow you to send requests and use the correct accessToken.

The token is generated with the HMACSHA256 algorithm, and it is used raw without any encoding to create a JWT signature.

Custom link example:

• Client applicant URL: <https://your-project.io/kyc>
• Secret key to sign the applicant link: 1
• externalUserId: userId_8
• clientId: sumsub

https://your-project.io/kyc?jwt=eyJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE2MjAwNTI1MjcsImV4cCI6MTYyMDY1NzMyNywic3ViIjoidXNlcklkXzgiLCJhdWQiOiJzdW1zdWIifQ.qCR-4VMfC_zOAN1hCtbjj9DJxmB6c0sEg7XD5Y8ZvvM

JWT data payload example:

{
  "iat": 1620052527, // Issued at (seconds since Unix epoch)
  "exp": 1620657327, // Valid until (seconds since Unix epoch)
  "sub": "userId_8",
  "aud": "sumsub"
}

Send branded emails

To customize email notifications with your brand, you will need to provide an icon, logo, and email sender (custom email address), as described in Branding.

When an applicant is asked to resubmit their documents (a Resubmission requested status), the individual and business verification-result emails include the specific rejection reason(s) recorded after verification. This covers both the overall review comment and, where applicable, reasons noted on individual rejected documents, shown as a bulleted list. Emails for a final rejection are not affected. The reason text is taken from the moderation comments on the applicant's review and on their declined documents.

All email texts can be customized as well for each locale from the Dashboard.

Configure SPF record

Create or edit an SPF record to reference Sumsub and add a TXT record to your domain DNS settings.

We recommend using the following SPF record to ensure that it is set up correctly: v=spf1 include:_spf.sumsub.com ~all

If you have already set up an SPF record for another purpose, you can simply add a reference to Sumsub: include:_spf.sumsub.com.

Configure DKIM record

Sumsub requires a CNAME record to automatically manage and rotate security keys on your behalf.

The CNAME records should be as follows:

sumsub1._domainkey CNAME sumsub1._domainkey.sumsub.com.
sumsub2._domainkey CNAME sumsub2._domainkey.sumsub.com.

However, when configuring your DKIM records in Cloudflare, verification may fail even if your DNS records are entered correctly.

If your Cloudflare account is configured to flatten all CNAMEs, Cloudflare will automatically follow the target and serve a raw TXT record to the public internet.

Sumsub explicitly checks for a CNAME delegation during verification; when it detects the flattened TXT record instead, it assumes the setup is incorrect and throws an error.

To ensure Sumsub can successfully verify your DKIM configuration, you must adjust/disable your CNAME Flattening settings and disable the proxy for these specific records.