Session API

Your backend creates one session per verification attempt and hands the session token to the app. Create it when the customer starts, not ahead of time — sessions are short-lived.

method POST path /api/blink/session/create auth client key + secret

Request

POST https://kyc-api.blink-pay.net/api/blink/session/createhttp

curl -sX POST https://kyc-api.blink-pay.net/api/blink/session/create \
  -H 'content-type: application/json' \
  -d '{
        "clientKey":    "bkyc_live_…",
        "clientSecret": "bksec_…",
        "purpose":      "FULL_CAPTURE",
        "userRef":      "customer-8841"
      }'

Field	Type	Required	Description
`clientKey`	string	yes	Your client key.
`clientSecret`	string	yes	Your client secret.
`purpose`	string	no	`FULL_CAPTURE` (default), `DOCUMENT_VERIFICATION`, `LIVENESS`, `FACE_MATCH`. See Use cases.
`userRef`	string	no	Your own opaque reference for the customer. Don't put personal data in it.
`originAllowlist`	string[]	no	Web only: browser origins allowed to use this session's token.

Response

200 OKjson

{
  "sessionId":    "[SESSION_ID]",
  "sessionToken": "bkyc_sess_…",
  "expiresAt":    "2026-09-15T18:42:10Z",
  "purpose":      "FULL_CAPTURE"
}

Field	Description
`sessionId`	UUID. Store it against your customer — you need it for the Result API. Never send it as a credential.
`sessionToken`	Give this, and only this, to the SDK or a hosted link.
`expiresAt`	When the token stops working.
`purpose`	The purpose the session was created with.

Example backend endpoint

Wrap the call in an endpoint of your own that your app calls after authenticating the customer:

server.jsjavascript

app.post('/kyc/sessions', requireUser, async (req, res) => {
  const r = await fetch('https://kyc-api.blink-pay.net/api/blink/session/create', {
    method: 'POST',
    headers: { 'content-type': 'application/json' },
    body: JSON.stringify({
      clientKey: process.env.BLINK_CLIENT_KEY,
      clientSecret: process.env.BLINK_CLIENT_SECRET,
      purpose: 'FULL_CAPTURE',
      userRef: req.user.id,
    }),
  });
  if (!r.ok) return res.status(502).json({ error: 'kyc_unavailable' });

  const { sessionId, sessionToken, expiresAt } = await r.json();
  await db.kycSessions.insert({ userId: req.user.id, sessionId, status: 'CREATED' });
  res.json({ sessionId, sessionToken, expiresAt });   // never the key or secret
});

A Dart version is in the Flutter guide.

Errors

Code	HTTP	Meaning
`BLINK_CLIENT_MISSING`	400	Credentials were not supplied.
`BLINK_CLIENT_AUTH_FAILED`	400	Credentials were not accepted.
`BLINK_UNKNOWN_PURPOSE`	400	`purpose` is not one of the four values.
`BLINK_SCOPE_DENIED`	400	That product is not enabled for your client.
`BLINK_QUOTA_EXCEEDED`	429	Your plan's quota is used up.
`BLINK_RATE_LIMITED`	429	Too many requests — wait for `Retry-After` seconds.