1) Get access
Book a demo
First book a demo so we can help scope your use case, recommend the right integration approach, and enable documentation access.
Access API documentation
After the demo, we’ll provide access to the Konfir API documentation: https://docs.konfir.com/
Receive API credentials
We’ll issue credentials for:
Sandbox (development/testing with mocked data)
Production (go-live)
2) Build your integration
Define entry/exit paths
Decide how applicants will start the Konfir journey from your product, i.e. where it sits in your workflow
Decide where applicants should return when they: submit, or exit early. Confirm internally what happens on exceptions (non-completion, not-connected activities, missing fields, documents not available)
Tip: Use state to pass your internal identifiers through the redirect so you can reconcile the applicant on return.
Fetch results
Confirm which outputs your system needs:
Retrieve Timeline
Request PDF
Retrieve Document
If you want event-driven updates, configure webhooks for:
verification completed
data source connected
Your endpoint must return HTTP 200. Konfir will retry failed deliveries.
3) Test in sandbox
Run sandbox tests
Use sandbox credentials to build and test end-to-end without real source connections. Behaviour mirrors production, but data is mocked.
Create a verification → hand off to candidate URL → complete sandbox connections → submit → return to your product.
Confirm:
your handoff UX works as intended
your state mapping/reconciliation works consistently
Your integration can fetch: timeline, PDF, documents (as required)
(if applicable) your integration handles webooks: receive events reliably and process retries safely
Test edge cases
Use Konfir’s pre-built personas to validate how your system handles different outcomes and result shapes (multi-activity timelines, insights/alerts, partial coverage, etc.).
4) Go live 🎉
Switch to production credentials
Update your production environment to use production keys only after sandbox tests are clean.
Before switching keys, confirm:
redirect URLs are correct and enabled
webhook URL is correct (if used)
any required allowlisting is complete (if your security model requires it)
Run a production test
Create a real verification and validate the production workflow.