> ## Documentation Index
> Fetch the complete documentation index at: https://www.dropfans.io/developers/llms.txt
> Use this file to discover all available pages before exploring further.

# POST /api/external/accounts/{id}/kyc-session — Get a fresh ID-check link

> The ID-check link for an account you created — when the first one expired, the creator closed it, or the check was declined and they may try again.

- Source: https://www.dropfans.io/developers/reference/create-kyc-session
- Section: API reference
- OpenAPI: https://www.dropfans.io/developers/openapi.json

The ID-check link for an account you created — when the first one expired, the creator closed it, or the check was declined and they may try again.

A link younger than 24 hours is reused unless you pass a new `kycReturnUrl`.

## Authentication

`Authorization: Bearer dpfn_...` — an API key generated in the creator's dashboard (Vault → API Connect). One key = one creator. Missing or invalid keys return 401 `{"error":"Unauthorized","code":"unauthorized"}`.

## Path parameters

| Field | Type | Required | Description |
|---|---|---|---|
| `id` | string | yes | The accountId. |

## Request body (application/json)

Optional.

| Field | Type | Required | Description |
|---|---|---|---|
| `kycReturnUrl` | string |  | https URL to return to; we append `?kyc=<status>`. |
| `acceptedFromIp` | string |  | The creator’s browser IP, when you have it. |
| `acceptedUserAgent` | string |  | The creator’s browser user agent. |

Example — New link with a return URL:

```json
{
  "kycReturnUrl": "https://crm.example.com/onboarding/done"
}
```

## Responses

### 200

The link.

| Field | Type | Required | Description |
|---|---|---|---|
| `kycUrl` | string | yes | Redirect the creator here. |
| `kycExpiresAt` | string | yes | Reused until then. |
| `reused` | boolean | yes | True when an open session was returned. |

```json
{
  "kycUrl": "https://verify.didit.me/session/…",
  "kycExpiresAt": "2026-10-18T16:00:00.000Z",
  "reused": false
}
```

## Errors

| Status | Body | When |
|---|---|---|
| 401 | `{"error":"Unauthorized","code":"unauthorized"}` | Missing or invalid API key. |
| 403 | `{"error":"This endpoint needs a key bound to an approved app.","code":"app_key_required"}` | A Personal key was used. |
| 403 | `{"error":"Use the app owner's key for this endpoint.","code":"owner_key_required"}` | The key was minted by a creator for themselves. App-level calls need a key held by your app owner: their own, or one their agency minted for its personas or managed creators. |
| 403 | `{"error":"This app is not enabled for this endpoint. Contact support.","code":"capability_missing"}` | Creator sign-up has not been enabled for your app yet. |
| 404 | `{"error":"Account not found"}` | No such account, or another app created it. |
| 409 | `{"error":"The ID check is already done.","code":"already_verified"}` | Approved (or being finalised) — nothing to do. |
| 503 | `{"error":"The ID check is unavailable right now. Try again later.","code":"kyc_unavailable"}` | The verification provider is down. |

## Rate limiting

Per-key fixed windows by tier (Personal 60/min · 5,000/day; approved apps 300/min · 50,000/day; Dropfans-operated integrations exempt). Read the live values from X-RateLimit-Tier, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset and their -Day variants; a 429 carries Retry-After and `{"error":"Rate limit exceeded","code":"rate_limited"}`. See [Rate limits](https://www.dropfans.io/developers/concepts/rate-limits.md).

## Code samples

### curl

```bash
curl -X POST "https://www.dropfans.io/api/external/accounts/$ID/kyc-session" \
  -H "Authorization: Bearer $DROPFANS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "kycReturnUrl": "https://crm.example.com/onboarding/done"
}'
```

### Node

```javascript
const id = '…'; // from an earlier response

const res = await fetch(`https://www.dropfans.io/api/external/accounts/${id}/kyc-session`, {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.DROPFANS_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "kycReturnUrl": "https://crm.example.com/onboarding/done"
  }),
});
console.log(await res.json());
```

### Python

```python
import os
import requests

id = "…"  # from an earlier response

res = requests.post(
    f"https://www.dropfans.io/api/external/accounts/{id}/kyc-session",
    headers={"Authorization": f"Bearer {os.environ['DROPFANS_API_KEY']}"},
    json={
        "kycReturnUrl": "https://crm.example.com/onboarding/done",
    },
)
print(res.json())
```

## OpenAPI

```json
{
  "method": "POST",
  "path": "/api/external/accounts/{id}/kyc-session",
  "operationId": "createKycSession",
  "tags": [
    "crm"
  ],
  "summary": "Get a fresh ID-check link",
  "description": "The ID-check link for an account you created — when the first one expired, the creator closed it, or the check was declined and they may try again.\n\nA link younger than 24 hours is reused unless you pass a new `kycReturnUrl`.",
  "parameters": [
    {
      "name": "id",
      "in": "path",
      "required": true,
      "description": "The accountId.",
      "schema": {
        "type": "string"
      },
      "example": "clxac0001acct"
    }
  ],
  "requestBody": {
    "required": true,
    "description": "Optional.",
    "content": {
      "application/json": {
        "schema": {
          "type": "object",
          "properties": {
            "kycReturnUrl": {
              "type": "string",
              "description": "https URL to return to; we append `?kyc=<status>`.",
              "format": "uri"
            },
            "acceptedFromIp": {
              "type": "string",
              "description": "The creator’s browser IP, when you have it."
            },
            "acceptedUserAgent": {
              "type": "string",
              "description": "The creator’s browser user agent."
            }
          }
        },
        "examples": {
          "retry": {
            "summary": "New link with a return URL",
            "value": {
              "kycReturnUrl": "https://crm.example.com/onboarding/done"
            }
          }
        }
      }
    }
  },
  "responses": {
    "200": {
      "description": "The link.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "kycUrl": {
                "type": "string",
                "description": "Redirect the creator here.",
                "format": "uri"
              },
              "kycExpiresAt": {
                "type": "string",
                "description": "Reused until then.",
                "format": "date-time"
              },
              "reused": {
                "type": "boolean",
                "description": "True when an open session was returned."
              }
            },
            "required": [
              "kycUrl",
              "kycExpiresAt",
              "reused"
            ]
          },
          "example": {
            "kycUrl": "https://verify.didit.me/session/…",
            "kycExpiresAt": "2026-10-18T16:00:00.000Z",
            "reused": false
          }
        }
      }
    },
    "401": {
      "description": "Missing or invalid API key.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message.",
                "example": "Rate limit exceeded"
              },
              "code": {
                "type": "string",
                "description": "Machine-readable code: unauthorized, app_suspended, first_party_only, rate_limited, username_required.",
                "example": "rate_limited"
              }
            },
            "required": [
              "error",
              "code"
            ]
          },
          "example": {
            "error": "Unauthorized",
            "code": "unauthorized"
          }
        }
      }
    },
    "403": {
      "description": "A Personal key was used. Also: The key was minted by a creator for themselves. App-level calls need a key held by your app owner: their own, or one their agency minted for its personas or managed creators. Also: Creator sign-up has not been enabled for your app yet.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message.",
                "example": "Rate limit exceeded"
              },
              "code": {
                "type": "string",
                "description": "Machine-readable code: unauthorized, app_suspended, first_party_only, rate_limited, username_required.",
                "example": "rate_limited"
              }
            },
            "required": [
              "error",
              "code"
            ]
          },
          "example": {
            "error": "This endpoint needs a key bound to an approved app.",
            "code": "app_key_required"
          }
        }
      }
    },
    "404": {
      "description": "No such account, or another app created it.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message describing what went wrong.",
                "example": "Vault item not found"
              }
            },
            "required": [
              "error"
            ]
          },
          "example": {
            "error": "Account not found"
          }
        }
      }
    },
    "409": {
      "description": "Approved (or being finalised) — nothing to do.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message.",
                "example": "Rate limit exceeded"
              },
              "code": {
                "type": "string",
                "description": "Machine-readable code: unauthorized, app_suspended, first_party_only, rate_limited, username_required.",
                "example": "rate_limited"
              }
            },
            "required": [
              "error",
              "code"
            ]
          },
          "example": {
            "error": "The ID check is already done.",
            "code": "already_verified"
          }
        }
      }
    },
    "429": {
      "description": "Rate limit exceeded for the current minute or day window. Wait Retry-After seconds and retry.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "Retry-After": {
          "description": "Seconds to wait before retrying (sent with 429s).",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message.",
                "example": "Rate limit exceeded"
              },
              "code": {
                "type": "string",
                "description": "Machine-readable code: unauthorized, app_suspended, first_party_only, rate_limited, username_required.",
                "example": "rate_limited"
              }
            },
            "required": [
              "error",
              "code"
            ]
          },
          "example": {
            "error": "Rate limit exceeded",
            "code": "rate_limited"
          }
        }
      }
    },
    "503": {
      "description": "The verification provider is down.",
      "headers": {
        "X-RateLimit-Tier": {
          "description": "Rate-limit tier of the key: personal, app or first_party (first_party is unlimited).",
          "schema": {
            "type": "string",
            "enum": [
              "personal",
              "app",
              "first_party"
            ]
          }
        },
        "X-RateLimit-Limit": {
          "description": "Requests allowed per minute for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining": {
          "description": "Requests left in the current minute window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset": {
          "description": "Epoch seconds when the minute window resets.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Limit-Day": {
          "description": "Requests allowed per UTC day for this key (absent on first_party).",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Remaining-Day": {
          "description": "Requests left in the current UTC day window.",
          "schema": {
            "type": "integer"
          }
        },
        "X-RateLimit-Reset-Day": {
          "description": "Epoch seconds when the day window resets.",
          "schema": {
            "type": "integer"
          }
        }
      },
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "string",
                "description": "Human-readable message.",
                "example": "Rate limit exceeded"
              },
              "code": {
                "type": "string",
                "description": "Machine-readable code: unauthorized, app_suspended, first_party_only, rate_limited, username_required.",
                "example": "rate_limited"
              }
            },
            "required": [
              "error",
              "code"
            ]
          },
          "example": {
            "error": "The ID check is unavailable right now. Try again later.",
            "code": "kyc_unavailable"
          }
        }
      }
    }
  },
  "x-codeSamples": [
    {
      "lang": "cURL",
      "label": "curl",
      "source": "curl -X POST \"https://www.dropfans.io/api/external/accounts/$ID/kyc-session\" \\\n  -H \"Authorization: Bearer $DROPFANS_API_KEY\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n  \"kycReturnUrl\": \"https://crm.example.com/onboarding/done\"\n}'"
    },
    {
      "lang": "JavaScript",
      "label": "Node",
      "source": "const id = '…'; // from an earlier response\n\nconst res = await fetch(`https://www.dropfans.io/api/external/accounts/${id}/kyc-session`, {\n  method: 'POST',\n  headers: {\n    Authorization: `Bearer ${process.env.DROPFANS_API_KEY}`,\n    'Content-Type': 'application/json',\n  },\n  body: JSON.stringify({\n    \"kycReturnUrl\": \"https://crm.example.com/onboarding/done\"\n  }),\n});\nconsole.log(await res.json());"
    },
    {
      "lang": "Python",
      "source": "import os\nimport requests\n\nid = \"…\"  # from an earlier response\n\nres = requests.post(\n    f\"https://www.dropfans.io/api/external/accounts/{id}/kyc-session\",\n    headers={\"Authorization\": f\"Bearer {os.environ['DROPFANS_API_KEY']}\"},\n    json={\n        \"kycReturnUrl\": \"https://crm.example.com/onboarding/done\",\n    },\n)\nprint(res.json())"
    }
  ],
  "x-dropfans-docs": "https://www.dropfans.io/developers/reference/create-kyc-session"
}
```

---

Previous: [Get an account you created](https://www.dropfans.io/developers/reference/get-account.md) · Next: [Get your webhook endpoint](https://www.dropfans.io/developers/reference/get-webhook.md) · All pages: [llms.txt](https://www.dropfans.io/developers/llms.txt)