Skip to main content
Some Etherfuse flows run inside the app, not over the API: the user completes them in their browser, in a real authenticated session. You send a user into one with a launch: sign a short-lived user JWT carrying the flow’s scope, then have the user’s browser hand it to /auth/launch with the flow’s target. The launch mechanism is identical for every flow and is documented once in JWT User Authentication. Only the scope and target change between flows; the full list is below.

​
Scopes

The scope claim is required on every partner JWT and names what the user may do. It is strictly enforced: the claim cannot be omitted, and any value other than a scope listed below is rejected with invalid_scope. Ask only for the scope a user needs.

​
Targets

The target is the app path the launch lands the user on. It must be one of the paths listed below, optionally with a query string (for example ?org=<org_id>, used by Business KYB). Any other path, or an absolute URL, is rejected with invalid_target, so a launch can’t be redirected off-site.

​
Flows

A launch’s JWT needs the matching scope, and the target must be the matching path.
The /agreements launch is deprecated. Agreement signing (electronic signature, terms and conditions, customer agreement) now happens inside /idv automatically; new integrations don’t launch a separate /agreements step.

​
Identity verification

scope: verification · target: /idv This is how a customer completes KYC. Launch them into /idv with sub = the customer’s org id (the id you used when creating their personal organization). In one hosted session the customer submits a government-issued ID, completes a liveness face scan, and signs the required agreements. Etherfuse reviews the result and approves; you’re notified via the kyc_updated webhook. See KYC WebSDK for the full walkthrough. Append &lang=es to render the entire flow in Spanish (all UI text, scan prompts, error messages, and status screens). Omit the parameter or pass lang=en for English. Example: /idv?lang=es.
Camera access. The face scan needs the camera. If you embed the launch in an iframe, the iframe element must delegate camera access with a wildcard origin: allow="camera *; microphone *". The bare form (allow="camera") only grants the camera to the iframe’s own src origin, but the scan SDK uses it from a nested frame, so without the * the browser blocks the camera and the scan never starts. A top-level tab or popup needs nothing extra.

​
Business KYB

scope: kyb · target: /kyb Use to send a user into Know Your Business verification. Append ?org=<org_id> to the target to choose which organization to verify; without it, the app uses the last organization that person selected, falling back to their first, and prompts them to create a business if they belong to none. See KYB WebSDK for the full walkthrough. The launch lands the user in a guided flow embedded in the app, which collects the company’s details and registry documents, the identity of the people who own and represent it, and Etherfuse’s compliance questionnaires. You’re notified of status changes via the kyb_updated webhook.
Camera access. The owner and representative identity checks need the camera, so an iframe embed carries the same requirement as /idv: allow="camera *; microphone *", with the wildcard. See the warning under Identity verification for why the bare form is not enough.