Identity Verification

Learn how to perform identity verification with Akahu

πŸ“˜

This guide is not applicable to Personal Apps. You must have a full app with identity permissions to follow this guide.

Akahu supports the retrieval of identity information using an OAuth2-like flow. Unlike our Authorization OAuth2 flow, the user is not required to create an Akahu account in order to verify their identity with you. This is because accessing identity data is a one time occurrence (i.e. we do not offer enduring consent). We do not store, log, or cache the user's login credentials, and all data retrieved through this endpoint is deleted within 30 days.

Prerequisites

Before we begin, you will need:

  • Your Akahu App ID Token.
  • Your Akahu App Secret.
  • Your Akahu app's Redirect URI.

The first two will be given to you when you register an app with Akahu.
Your Redirect URI must be one of those you supplied when registering your app with Akahu.

⚠

️

Make sure you keep your App Secret private! Never include it in any frontend or user-accessible source code. We recommend you use environment variables to store the secret.

The Authorization Request

To begin the OAuth flow, the user must be directed to https://oauth.akahu.io/, with several query parameters set.

ParameterExampleDescription
response_typecodeThe type of oauth response. The only supported value is "code".
client_idapp_token_111111111111111111111111Your App ID Token.
redirect_urihttps://example.com/auth/akahu_identityWhere to redirect the user once they have accepted or rejected the authorization. This must match one of your app's Redirect URIs.
state1234567890(Optional) An arbritary string that will be returned with the Authorization Code. Useful to keep track of request-specific state and to prevent CSRF attacks.
scopeONEOFFThe type of data you want. ONEOFF will begin a one-off identity verification flow.

Here is an example uri using the values above, with newlines included for readability:

https://oauth.akahu.io?
  response_type=code&
  client_id=<<appToken>>&
  redirect_uri=https%3A%2F%2Fexample.com%2Fauth%2Fakahu_identity&
  state=1234567890&
  scope=ONEOFF

πŸ‘

By default, you only need to supply Akahu with the scope for the type of OAuth request you wish to perform. Akahu will automatically add all of the additional scopes that your app is allowed to access. If you wish to only request a subset of your app's available scopes, simply set the scope parameter to a space-separated list of the scopes you desire.

The Authorization Response

The user's authorization response is delivered to your app by redirecting the user to your app's Redirect URI, with results included in the query parameters.

A Successful Response

Once the user accepts your app's request for authorization, they will be returned to your Redirect URI with the following query parameters:

ParameterExampleDescription
codeid_1111111111111111111111111An OAuth Result Code. Keep track of this for the next step.
state1234567890The state you supplied when you made the request.

An Error Response

Two types of errors can be returned:

  • An access denied error. The user has declined to give your app access to their statements.
  • A configuration error. There was something wrong with your authorization request.

Details are supplied by the error and error_description (optional) query parameters.

The error codes given are standard for OAuth implementations, for more details see this document.

Retrieving Identity Results with the OAuth Result Code

πŸ“˜

At this point we diverge from the typical OAuth2 flow.

In order to get the identity data, make a GET request to the /identity/id_1111111111111111111111111 endpoint (Reference).

This request must be authorised as your app using Basic HTTP auth. See the API reference for more details.

A Successful Response

If all parameters are correct you will receive a JSON response body with the following keys:

KeyExampleDescription
successtrueIndicates that the operation was successful.
itemsee belowStatus of the identity request.

The item returned will have the following keys.

KeyExampleDescription
_idid_1111111111111111111111111This OAuth request's ID.
statusPROCESSINGStatus of the OAuth request. This will be one of: PROCESSING, COMPLETE, REVIEW or ERROR.
created_at2000-01-01T01:00:00.000ZThe time at which the OAuth request was created.
updated_at2000-01-01T01:00:00.000ZThe time at which the OAuth request was last updated.
expires_at2000-01-01T01:00:00.000ZThe time at which this identity result will be securely deleted from Akahu's systems. This is typically 30 days after creation.
sourceJSON objectDetails of the institution from which the data has been sourced.
errors[String]Any non-fatal errors that Akahu has encountered while retrieving the data.
identities[JSON object]Data regarding the user's name and gender. Will be included if your app has the required permissions to view it.
addresses[JSON object]Data regarding the user's addresses. Will be included if your app has the required permissions to view it.
accounts[JSON object]Data regarding the user's bank account. Will be included if your app has the required permissions to view it.

An example response can be seen in the API Reference.

An Error Response

If the response success key is false, details are supplied in the message key.


Did this page help you?