Go-live checklist

Work top to bottom. Each item links to the page with the full detail.

1 · Sandbox testing#

Before spending a credit, prove every branch of your integration against the deterministic sandbox using an ok_test_ key. Sandbox verifications are free and resolve consistently, so you can assert on each outcome.

• Confirm you correctly handle APPROVED, REVIEW, DECLINED and ERROR.
• Check your webhook handler verifies signatures and de-duplicates deliveries.
• Verify your retry/backoff logic against simulated failures.

See test vs live keys and statuses.

2 · Fund credits (USDT top-up)#

Live verifications draw down credits at $0.15 each. Fund your balance with USDT from Dashboard → Billing — OKIAS runs its own crypto top-up, so there is no third-party processor fee.

In the dashboard you request a deposit address for your chosen network and send USDT to it. Under the hood:

curl https://api.okias.io/v1/payments/crypto/address \
  -H "Authorization: Bearer <dashboard-session>" \
  -H "Content-Type: application/json" \
  -d '{ "network": "TRON" }'

3 · Switch to production keys#

Replace your ok_test_ key with an ok_live_ key in your production environment. Live keys run real checks and bill one credit per approved full KYC — declined, review and errored checks are free.

• Create a dedicated live key named for the service (e.g. web-prod).
• Store it in your secret manager — never in source control or the client.
• Scope it to only the checks that service needs.

See managing keys.

4 · Webhook setup#

Register your production webhook endpoint and verify the HMAC signature on every delivery. Do this before go-live so you never miss a decision.

• Register the endpoint and store the whsec_ secret as OKIAS_WEBHOOK_SECRET.
• Fire a test event and confirm your signature check passes.
• Implement replay protection (timestamp tolerance) and de-dupe on X-Okias-Delivery.
• Return 2xx fast; process heavy work asynchronously.

Full detail and copy-paste verification snippets in Webhooks.

5 · Compliance notes#

• Supported countries. Verification is available for supported countries only. Some jurisdictions are hard-blocked (for example, Israel) and will return COUNTRY_NOT_SUPPORTED — this cannot be overridden.
• Sanctions screening. The name read from the document is screened against consolidated sanctions data imported from the official primary sources — 31,825 entries across five lists, refreshed automatically every 24 hours. A possible match surfaces as SANCTIONS_POSSIBLE_MATCH and routes the verification to human review; it never auto-declines. Screening is labelled beta for one honest reason: name matching is order-sensitive, so an entry stored surname-first on one list may score below threshold even when the same person matches on another list. Treat OKIAS screening as one control among several, not as your sole sanctions defence. Details below.
• Consent & data handling. Collect user consent for identity and biometric processing, and handle personal data per your obligations. Review the Privacy Policy and AML / KYC pages.
• Terms. Production use is governed by the Terms of Service.

Which sanctions lists we screen#

The screening data is imported directly from each issuing authority's published file — not a third-party aggregator — and each source is swapped in atomically, so a failed download of one list never leaves you screening against a truncated one. Every refresh is written to the audit log.

• Refreshed every 24 hours, automatically. Aliases and AKAs are kept and matched alongside primary names.
• Matching is fuzzy, so it is advisory. Names are compared with a normalised Jaro-Winkler similarity above a configured threshold. That deliberately catches transliteration variants — and therefore produces false positives, which is exactly why a hit routes to a human rather than to a decision.
• A hit never auto-declines. It forces the verification to REVIEW for human adjudication, and you receive a verification.review event followed by a final one when the reviewer resolves it.
• Screening runs when a name was extracted. If the document yielded no usable name there is nothing to screen, and no sanctions signal is contributed to the score.

You're live#

With the checklist green, you are running real verifications. Monitor decisions on your webhook, keep an eye on your credit balance, and rotate keys periodically. Welcome aboard.

Next steps#