Invitations and hosted verification settings
Every hosted verification link, whether your server creates it by API or a person creates it in Backoffice, shows the customer the page you configure under Identity Verification → KYC Invitations → Settings. This guide takes an administrator from an empty configuration to a working invitation, and a reviewer through reading the result. You do not write code for anything on this page.
If your server creates the links, set up the Settings tab here first and then follow Identity verification integration.
What it is
Availability: Controlled availability. Identity verification is provisioned per tenant by your account team; see the product page for the overview and the limits of the result.
The KYC Invitations page in Backoffice (route /kyc/invitations, in the Identity Verification group of the navigation) has three tabs. The active tab is kept in the address as ?tab=history, ?tab=active or ?tab=settings.
| Tab | What it is for |
|---|---|
| History (the default) | The durable list of every invitation your tenant has started, plus a lookup by session id. |
| Active invitations | The one-time links you started in this browser tab. Links are shown here once and are not saved anywhere else. |
| Settings | The setup status, the verification steps, the hosted page configuration and the legal basis. |
Who can do what:
- An analyst or above can open the page and read the History tab.
- An administrator can create invitations, save the hosted configuration and record the legal basis. Creating an invitation and saving the configuration each ask for a fresh step-up verification of the signed-in person.
- Anyone who sees “KYC verification is not enabled” is working in a tenant whose module is not provisioned yet. Ask your account team.
A link created here carries no return link: after the customer finishes there is no “Return to your business” button. Return links belong to sessions created by API. Invitations created here cannot be re-sent or revoked from the page. When a link is lost or should no longer be used, start a new invitation and let the old one expire.
Prerequisites
- The identity verification module is provisioned for your tenant. The Settings tab lists it at the top of the setup status when it is missing.
- An administrator account with fresh step-up verification available. A viewer or analyst can read but cannot create or save.
- The text your customers will see: your business name, the purpose of the verification in one plain sentence, the address of your privacy notice (a complete
httpsaddress), a version label for that notice, and the documents you accept with their issuing countries. - The legal basis your organisation relies on. An authorised person in your organisation records it. Noxtica does not choose one for you.
- Optional: the host names of your own pages if API-created sessions should offer a return link, a server key and an events endpoint if your server will also create sessions (Identity verification integration).
Steps
1. Open the Settings tab and read the setup status
Open Backoffice → Identity Verification → KYC Invitations → Settings. The setup status lists what is done and what is missing, and each open row links to the control that fixes it.
| Row | What it checks |
|---|---|
| KYC verification module | The module is active for your organisation. |
| Hosted verification links | The deployment can issue signed hosted links. A message here means something only Noxtica operates is not ready; contact your account team. |
| Hosted verification page | Business name, privacy notice and accepted documents are saved. |
| Legal basis | An active legal basis covers hosted identity verification. |
| Return destination | Optional. A host name approved for return links on API-created sessions. |
| Server API key | Optional. A server key with the identity permission exists. |
| Webhook endpoint | Optional. An endpoint receives identity events. |
Until the required rows are done, a customer who opens a link sees “Verification isn’t ready yet”, and Backoffice does not let you create invitations.
2. Fill in the hosted verification configuration
Select Edit configuration. The form is prefilled and shows a customer preview beside it. Each prefilled value is labelled Saved, From your workspace or Suggested — check it, so you can see where it came from and confirm it before you save. When a value is wrong, for example an address without https://, the message under the field names the exact correction and offers it as one click. Fields marked with an asterisk are required.
| Field | Required | What it does |
|---|---|---|
| Business name | Yes | The organisation name at the top of the verification page. |
| Verification purpose | Yes | A plain-language reason shown before the customer agrees to continue. |
| Privacy policy URL | Yes | A complete https address. The form tells you when a scheme is missing or wrong. |
| Privacy notice version | Yes | A short version or date that customers and audit records can identify. |
| Support URL | No | An https address for customers who need help. |
| Supported documents | Yes | Each document a customer may use, with its issuing countries as two-letter codes such as TR or GB. Select at least one. |
| Verification checks and mode settings | Per form | The remaining switches in the “Verification checks” section. The setup status and the Verification steps guide show what each does for your organisation. |
| Email verification | No | Whether customers confirm an email address: Off, Optional or Required. It applies to every link unless you choose otherwise when creating one, and is offered only when enabled for your organisation. |
| Allowed return hosts | No | Host names only, with no https://, path, port or wildcard. Used by API-created sessions that carry a returnUrl. |
Select Save configuration. Saving asks for a fresh step-up verification. The form shows the time of the last update.
3. Review the verification steps
The Verification steps guide on the same tab lists every step the hosted page can ask a customer to complete, whether it is on for your organisation, and a link to the control that switches it on. A step marked “Per invitation” is chosen each time you create an invitation. A step marked unavailable needs something Noxtica operates, or an approval of your own, before it can be used.
4. Record the legal basis
In the Legal basis section of the same tab, an authorised person records the lawful basis your organisation relies on for the hosted capture surface, and the additional condition your counsel requires, if any. Recording, superseding and revoking are separate actions and each is listed with its date. Until a basis is active, customers cannot submit a verification and an API-created session is refused with kyc_legal_basis_receipt_required.
5. Try it with a test invitation
In the configuration editor, use Save & send test invitation to myself. It saves the form, then starts an invitation for you under a customer reference that begins with test-operator-, so you can open it on your own device and see what a customer sees. The Integration tab’s setup guide offers the same action as Create a test invitation. It is a real invitation: it appears in History and a finished capture waits in the review queue like any other.
6. Send a real invitation
- Select New invitation.
- Enter a Customer reference: your own opaque reference, 1 to 256 characters. Use an identifier from your system, not a name or a document number.
- Choose the Document type.
- Optional: set Expires in (minutes). Leave it blank for the default of 24 hours. The accepted range is 5 to 10080 minutes; a value outside it is refused.
- Optional: choose the email verification mode for this link. “Use organisation default” follows your configuration.
- Select Start verification.
The page switches to Active invitations and shows the one-time link with a copy button and a QR code. Copy it now: it is shown once, in this browser tab, and is not saved. Send it to the customer through your own channel or show the QR code so the customer can continue on a phone.
A request is refused with “This organisation hasn’t finished setting up KYC verification” (kyc_not_ready) when the setup status still shows a required row open.
7. Follow the invitation and read the result
Open the History tab. Each row shows the invitation status, its expiry and, once the customer cancels, the time and the reason they gave. The statuses are the same as in the session status read: pending, opened, verifying, review_pending, completed, unverified, error, expired and cancelled_by_user.
- Use Check invitation status by id when a session id reaches you outside the list, for example in a support ticket.
- A finished capture currently waits as
review_pending. Select Review this verification to open the case under Identity Verification → KYC Verifications, or work from Identity Verification → KYC Review Queue. A reviewer with the manage permission and fresh step-up verification records the decision. - “Completion is not the same as approval”: an invitation that finished without a linked verification has nothing to review yet.
To be told when a decision is recorded, register an endpoint under Integrations → Webhooks and subscribe it to identity events (Identity verification events and webhooks).
Verify it works
- The setup status shows no open required row, and the preview shows your business name and privacy notice.
- Your test invitation opens on your own device and shows your business name; the History tab lists it as
openedand laterreview_pendingor another final status. - A real invitation appears in History within moments of Start verification.
- If you registered an endpoint, it receives an identity event after a decision.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| “KYC verification is not enabled” | The module is not provisioned for this tenant. | Ask your account team. |
| The customer sees “Verification isn’t ready yet” | The hosted page is not configured or no legal basis is active. | Complete the open rows in the setup status. |
New invitation is disabled or refused with kyc_not_ready | A required setup row is still open. | Open the Settings tab and fix the rows it lists. |
“Enter a valid expiry in minutes” (invalid_ttl) | The expiry is empty text, zero, negative or outside 5 to 10080 minutes. | Enter a number inside the range or leave it blank. |
| The form will not save | A required field is empty, the privacy address is not a complete https address, or a document has no issuing country. | Follow the message under the field; it names the exact fix. |
| The page asks for step-up again | Creating invitations and saving settings need a fresh check. | Complete it and repeat the action. |
| A link was lost | Links are shown once and cannot be shown again or revoked from the page. | Start a new invitation. |
| “Email verification is not available” | The option is not enabled for your organisation. | Choose “Use organisation default” or “Off”, or ask your account team. |
| A message says the deployment cannot create hosted links | Something only Noxtica operates is not ready. | Contact your account team with the time of the attempt. |
Related
- Identity verification integration: create hosted sessions from your server.
- Self-hosted identity verification (direct API): the direct API and its limits today.
- Identity verification events and webhooks: every identity event and its payload.
- Verification data: storage, access and deletion: where verification data lives and how it is deleted.
- KYC Hosted Sessions: link lifetime, the capture window and expiry.