> ## Documentation Index
> Fetch the complete documentation index at: https://docs.verisecid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Development

title: 'Development'
description: 'KYC integration details: hosts, auth, environment, lifecycle'

<Info>
  **Prerequisites**:

  * Node.js version 19 or higher
  * A docs repository with a `docs.json` file
  * A VerisecID public API key (e.g., `pb-xxxxx`)
</Info>

## Authentication

Pass your public key as a Bearer token. Public keys map to workspaces in Firestore under `workspaces.apiPublicKey`.

```http theme={null}
Authorization: Bearer pb-YourPublicKey
```

## Hosts and CORS

API requests are served only when the Host header matches an allowlist.

Default allowed hosts:

* `api.verisecid.com`, `localhost`, `127.0.0.1`

Override with env var:

```bash theme={null}
API_ALLOWED_HOSTS=api.verisecid.com,localhost,127.0.0.1
```

When a host is not allowed, handlers return `404` with `{ "error": "invalid_host" }`.

## Endpoints

* Create session: `POST /v1/kyc/sessions`
* Get session: `GET /v1/kyc/sessions/{sessionId}`

## Access control

* 401 `{ "error": "missing_authorization" }` when header is absent
* 401 `{ "error": "invalid_credentials" }` when public key is invalid
* 403 `{ "error": "forbidden" }` when the user does not own the session/workspace

## Environment variables

* `API_ALLOWED_HOSTS` (optional) — comma-separated hostnames allowed for `/api/*`.
* Firebase client (for app UI) requires standard `NEXT_PUBLIC_FIREBASE_*` variables.
* Server-side verification actions may require AI provider keys (e.g., `OPENAI_API_KEY`).

## Session lifecycle

* Initial: `not_started`
* Typical progression: `not_started` → `processing` → `completed` (or `failed`)
* Verify UI prevents reuse when `status === "completed"`.

## Operational notes

* Base host: `https://api.verisecid.com`
* Allowed hosts: `api.verisecid.com`, `localhost`, `127.0.0.1`
* Override with env var: `API_ALLOWED_HOSTS=api.verisecid.com,localhost,127.0.0.1`
* Disallowed hosts return `404` with `{ "error": "invalid_host" }`

## Session lifecycle

* Initial: `not_started`
* Typical progression: `not_started` → `processing` → `completed` (or `failed`)
* Verify UI prevents reuse when `status === "completed"`.