Reusable KYC — Gateway lets non-regulated businesses help their users reuse identity verification at regulated partner services without collecting or storing the user’s identity documents, biometric data, or verification results.

In a standard Reusable KYC flow, one regulated business shares verification data with another regulated business. In this flow, the reused data exists because the donor runs its own KYC.

Gateway extends this model to non-regulated businesses that do not run KYC themselves. In Gateway, the non-regulated business acts as the integrator, and the source of reused data becomes the user’s own Sumsub ID account.

The integrator embeds a Verify with Sumsub ID button in its product — conceptually similar to Sign in with Google. The button opens a Sumsub-hosted flow where the user signs in to or creates their Sumsub ID account, completes identity verification if needed, and authorizes the integrator to generate share tokens on their behalf.

The integrator then passes share tokens to regulated partner services, called recipients, who ingest them through Reusable KYC via API or SDK. Sumsub retrieves matching data from the user’s Sumsub ID account and runs the recipient’s configured Reusable KYC checks. All checks run fresh in the recipient’s Reusable KYC flow, Sumsub does not copy check results from the Sumsub ID account.

Gateway uses Sumsub ID — OIDC as a technical building block for connecting the integrator’s product to the user’s Sumsub ID account. For detailed OIDC setup, supported scopes, and JavaScript library options, see this article.

How Reusable KYC — Gateway works

Gateway involves three roles:

• Integrator — a non-regulated business that embeds the Verify with Sumsub ID button in its product. The integrator connects the user’s Sumsub ID account and obtains permission to generate share tokens.
• Recipient — a regulated business that receives verified applicant data through Reusable KYC via API or SDK.
• Source — the user’s Sumsub ID account, which stores verified documents and data. The user controls sharing from this account.

📘

Note

The integrator is not the source of documents, verification data, or verification results. Sumsub retrieves the reused data from the user’s Sumsub ID account after the user authorizes sharing.

The Gateway flow consists of three main stages:

1. Connection. The user connects their Sumsub ID account to the integrator through a Sumsub-hosted flow. During this step, the user authorizes the integrator to generate Sumsub ID share tokens.
   If the user already has a verified Sumsub ID account, they can proceed directly to authorization. If they do not have a Sumsub ID account, they create one and complete the required verification checks.
2. Share token generation. When the user moves from the integrator’s product to a recipient service, the integrator generates a Sumsub ID share token for that specific recipient.
   
   If the user has not yet authorized sharing with this recipient, the integrator redirects the user to a Sumsub-hosted consent screen.
3. Reusable KYC. The recipient ingests the share token through Reusable KYC via API or SDK. Sumsub checks the user’s authorization, retrieves matching data from the user’s Sumsub ID account, and applies the recipient’s verification level requirements.

📘

Note

Gateway reuses verified documents and data from the user’s Sumsub ID account, but the recipient’s checks run in the recipient’s own Reusable KYC flow. Sumsub applies the recipient’s level requirements and check configuration instead of copying existing check results from the Sumsub ID account.

Setup for integrators

Before starting the integration:

1. Sign up for Reusable KYC — Gateway with Sumsub.
2. Receive your integrator client key.
3. Make sure the following scopes are enabled for your client key:
   • openid
   • email
   • share
   • offline_access
4. Register your redirect URI in the Dashboard in the OIDC Settings section.

⚠️

Important

Sumsub enforces scope restrictions server-side. Gateway integrators cannot request additional personal-data scopes by default. Contact Sumsub if your flow requires more scopes.

The integrator receives only the data required to identify the connected Sumsub ID account and generate share tokens.

📘

Note

The integrator does not receive:

• User identity data, such as name, date of birth, nationality, or document images.
• Biometric data.
• The recipient’s KYC result.
• Check results from the recipient’s verification flow.

Once all the prerequisites are met, complete the following steps to set up Gateway as an integrator.

Step 1: Embed Verify with Sumsub ID button

Gateway uses Sumsub ID — OIDC to connect the user’s Sumsub ID account and authorize share-token generation. For more detailed OIDC setup options, see this article.

Use the Sumsub ID Connect JavaScript library to add the Verify with Sumsub ID button to your product.

Install the package:

npm install @sumsub/id-connect

Alternatively, use the UMD build:

<script src="https://unpkg.com/@sumsub/id-connect/dist/index.umd.js"></script>

Render the button:

import { createButton } from '@sumsub/id-connect';

createButton({
  clientId: 'your-integrator-client-id',
  permissions: ['share'],          // Gateway requires the 'share' scope
  container: document.getElementById('button-container'),
  onSuccess: (response) => {
    // Pass response.code to your backend immediately — codes are short-lived
    sendCodeToBackend(response.code);
  },
  onError: (error) => console.error('Authorization error:', error.message),
  text: 'Verify with Sumsub ID'
});

The share scope lets the user authorize your service to generate Sumsub ID share tokens.

Step 2: Exchange authorization code

After the user completes the Sumsub-hosted flow, your frontend receives an authorization code. Send this code to your backend and exchange it for a Sumsub ID Connect token.

Use the client secret from the OIDC Settings page:

curl -X POST 'https://id.sumsub.com/resources/snsId/api/connect/token' \
  -H 'content-type: application/json' \
  -d '{
    "grant_type": "authorization_code",
    "code": "<authorization_code>",
    "codeVerifier": "<pkce_code_verifier>"
  }'

The response contains the Sumsub ID Connect token (JWT). Store this token securely against your internal user record and use it to generate share tokens.

⚠️

Important

Exchange the authorization code as soon as you receive it. Authorization codes are short-lived.

Step 3: Generate Sumsub ID share token

When the user proceeds to a recipient partner, generate a Sumsub ID share token for that specific recipient. To do so, use this API method.

Request example:

curl -X POST 'https://api.sumsub.com/resources/accessTokens/sumsubIdShareToken' \
 -H 'content-type: application/json' \
 -d '{
   "sumsubIdConnectToken": "<token_from_step_2>",
   "forClientId": "RecipientClientId",
   "ttlInSecs": "1800"
 }'

Response example:

{
  "token": "_act-snsId-08c4d85d-d0ae-43d6-81e9-a57d4f8e3768",
  "forClientId": "RecipientClientId",
  "sharingAllowed": true
}

📘

Note

Treat Sumsub ID Connect tokens and Sumsub ID share tokens as opaque values. Do not parse, analyze, or rely on their internal structure. Token formats may change without notice. Maximum token length — 1 KB.

Collect consent for recipient

If sharingAllowed is false, the user has not yet authorized sharing with this recipient. Generate a share consent link and redirect the user to the Sumsub-hosted consent screen.

To collect this permission, use this API method to request a share link. Request example:

curl --request POST \
 --url https://api.sumsub.com/resources/snsId/oauth/shareLink \
 --header 'Authorization: Bearer <integrator_token>' \
 --data '{
   "redirectUri": "https://your-app.example/sumsub-share-callback",
   "forClientId": "RecipientClientId",
   "displayMode": "page",
   "state": "<your_custom_state>"
 }'

Sumsub returns a short-lived link. Redirect the user to this link.

After the user accepts or declines sharing, Sumsub redirects them back to the redirectUri and adds a signed JWT in the token query parameter. The JWT contains the sharingAllowed field.

Check sharingAllowed before continuing:

• If sharingAllowed is true, pass the share token to the recipient.
• If sharingAllowed is false, stop the flow and do not pass the share token.

Sumsub records consent per integrator, recipient, and user combination. Consent for one recipient does not apply to another recipient.

📘

Note

Check whether the share token generated before consent remains valid after the user grants consent, or whether the integrator must generate a new share token before passing it to the recipient.

Step 4: Pass share token to recipient

Pass the Sumsub ID share token to the recipient when the user moves from your product to the recipient’s flow. Use a secure backend-to-backend transfer where possible.

The recipient then submits the token through Reusable KYC via API.

Request example:

 curl -X POST \
      'https://api.sumsub.com/resources/api/reusableIdentity/reuse?shareToken=_act-jwt-eyJhbGciOiJub25lIn0.eyJqdGkiOiJfYWN0LTE3YjM5YTljLWRhOWUtNGY2MS04Y2ZjLTYwNzViNWM2NDk5MSIsInVybCI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA5MCJ9.&levelName=liveness-id-poa' \
      -H 'X-App-Token: <your-app-token>' \
      -H 'X-App-Access-Sig: <your-signature>' \
      -H 'X-App-Access-Ts: <unix-timestamp>'

⚠️

Important

Sumsub ID share tokens are single-use. Generate a new token each time you pass a user to a recipient.

User experience

The user experience depends on whether the user already has a Sumsub ID account.

Existing Sumsub ID account

If Sumsub ID already exists and contains requested verified data:

1. Authentication. User provides and confirms their email address.
2. Authorisation. User gives permission for integrator to generate share tokens.

Non-existing Sumsub ID account

If Sumsub ID does not exist:

1. Authentication. User provides and confirms their email address.
2. Sumsub ID account creation. User will be prompted to create a Sumsub ID account.
3. Verification. Sumsub runs the checks needed to provide the requested data. These checks depend on the scopes you ask for and the steps already completed by the applicant.
4. Authorisation. User gives permission for integrator to generate share tokens.

When the user proceeds to a recipient for the first time, Sumsub may also show a consent screen for that specific recipient.

After the user authorizes sharing with a recipient, the recipient-side API flow does not require additional user screens.

📘

Note

Users can revoke the connection from their Sumsub ID account at any time. After revocation, the integrator can no longer generate share tokens for that user unless the user authorizes the connection again.

Setup for recipients

Before receiving data through Gateway:

1. Subscribe to Reusable KYC — Gateway.
2. Make sure Reusable KYC is enabled for your account.
3. Add the integrator as a donor in the Dashboard. For more information, refer to this article.

📘

Note

The Dashboard currently lists integrators under the Donor tab. In Gateway, the integrator does not provide KYC data. Sumsub retrieves the data from the user’s Sumsub ID account.

Reuse data via API

When the Integrator passes you a Sumsub ID share token, submit it through the standard Reusable KYC via API method.

Request example:

curl -X POST \
 'https://api.sumsub.com/resources/api/reusableIdentity/reuse?shareToken=_act-snsId-08c4d85d-d0ae-43d6-81e9-a57d4f8e3768&levelName=liveness-id-poa'

After receiving the request, Sumsub:

1. Checks that the user authorized sharing with your client ID.
2. Retrieves matching data from the user’s Sumsub ID account.
3. Runs the standard Reusable KYC via API flow against your level requirements.
4. Creates or updates the applicant on your side.

If the reused data satisfies the level requirements and all checks pass, Sumsub approves the applicant.

Reuse data via SDK

Gateway also supports SDK-based reuse. In this flow, the user can choose which documents and data to share from their Sumsub ID account and completes a liveness check.

To start the SDK flow, include the Sumsub ID share token when generating an SDK access token.

Request example:

curl --request POST \
 --url https://api.sumsub.com/resources/accessTokens/sdk \
 --header 'content-type: application/json' \
 --data '{
   "applicantIdentifiers": {
     "email": "[email protected]",
     "phone": "555-1111"
   },
   "ttlInSecs": 600,
   "shareToken": "_act-snsId-08c4d85d-d0ae-43d6-81e9-a57d4f8e3768",
   "userId": "endUserId",
   "levelName": "basic-kyc-level"
 }'

Including the share token triggers the Sumsub ID reuse flow inside the SDK. The user selects which data to share, completes the required liveness check, and submits the data to your verification level.

What recipient receives

As a Recipient, you receive:

1. An applicant profile created or updated on your side.
2. Documents and data from the user’s Sumsub ID account that match your verification level.
3. Check results for the checks configured in your level.

If all required checks pass, Sumsub approves the applicant. The recipient receives a completed KYC result while reducing the number of actions required from the user.

Data privacy (GDPR/UK GDPR)

The Sumsub-hosted connection flow and per-recipient consent screen collect user authorization for the Sumsub ID to recipient data transfer. Integrators and recipients remain responsible for their own data-protection obligations, including GDPR and UK GDPR obligations where applicable.