Identity verification, as a service.
A standalone, multi-tenant KYC microservice. It owns all verification data, talks to a swappable verification engine (Sumsub or a built-in in-house engine), and pushes a signed status callback to each client whenever a user's verification status changes.
Base URL https://kyc.clistech.com · all endpoints under
/api/v1 · JSON in, JSON out.
How it fits together
Multi-tenant
Every client app is a Project with its own API key/secret,
branding, callback endpoint and engine. Unknown key → 401.
Owns its data
No shared DB or user model. End users are referenced only by
external_user_id — the client's own id, scoped per project.
Swappable engine
Sumsub or the built-in in-house engine, chosen per project and resolved at runtime. One interface, one switch.
Signed callbacks
Durable, retrying POST to the project's callback URL on
every coarse status change, HMAC-SHA256 signed.
Fully async
Django + django-ninja on ASGI, async ORM and provider calls, Celery for webhooks and callback delivery.
Encrypted at rest
PII fields (moderation comments, engine documents, applicant data, callback secrets) are Fernet-encrypted in the database.
Quickstart (client backend)
You'll get an api_key (pk_…) and api_secret
(sk_…) for your project. Send both headers on every request.
1 — mint an SDK token for a user
curl -X POST https://kyc.clistech.com/api/v1/kyc/access-token \
-H "X-Api-Key: $KYC_API_KEY" \
-H "X-Api-Secret: $KYC_API_SECRET" \
-H "Content-Type: application/json" \
-d '{"external_user_id": "42"}'2 — check status any time
curl https://kyc.clistech.com/api/v1/kyc/status/42 \
-H "X-Api-Key: $KYC_API_KEY" -H "X-Api-Secret: $KYC_API_SECRET"3 — receive the signed status callback
When a user's status changes, this service POSTs the status
snapshot to your project's callback_url with header
X-Kyc-Signature: hex(hmac_sha256(callback_secret, body)).
Verify it constant-time, update your denormalized field, return
2xx.