All Sumsub API requests require authentication using an app token and a signed request signature. The app token identifies your integration, while the signature — generated with HMAC-SHA256 — ensures each request is tamper-proof and tied to a specific timestamp. Together, they are passed as HTTP headers on every call.

Generate app token

An app token authenticates your requests to the Sumsub API. You can create one in the Dashboard — see App Tokens for instructions. For Web and Mobile SDK integrations, see Generate Access Token.

Make requests

All requests must contain the following headers:

• X-App-Token — an app token that you generate in the Dashboard.
• X-App-Access-Sig — a request signature in the HEX format and lowercase.
• X-App-Access-Ts — a number of seconds since Unix Epoch in UTC.

Sign requests

The X-App-Access-Sig header value is an HMAC-SHA256 signature computed using your secret key (provided upon app token generation) over the concatenation of the following:

• The value of the X-App-Access-Ts header as a string.
• An HTTP method in uppercase, for example, GET or POST.
• The request URI, excluding the host, starting with a slash, and including all query parameters, for example, /resources/applicants/123?fields=info.
• The request body exactly as sent. Omit if there is no body, for example, for GET requests.

The following is an example of the string to be signed to get an access token:

1607551635POST/resources/accessTokens/sdk{"ttlInSecs": 600, "userId": "johndoeID", "levelName": "basic-kyc-level"}

Examples of how you can sign your requests:

• JS
• Java
• PHP (Guzzle)
• Python
• Ruby
• GO
• C#