What am I responsible for?
What am I responsible for?
- The accuracy of the customer data you submit.
- Never presenting the cards as anonymous, or as available without identity checks, in your product and your marketing.
- The security of your API keys, of the data that goes through your servers and of your webhook endpoint.
Who verifies the identity of my customers?
Who verifies the identity of my customers?
KemyCard, through a hosted verification link returned by the API: a government-issued identity document with a liveness check, then a proof of address. You receive the result by webhook. See KYC levels, KYC flow and Proof of address.
Do I need a PCI certification?
Do I need a PCI certification?
We do not require one to integrate the API. The card number, expiry and CVV do pass through your server when you call
GET /cards/{code}/sensitive, so you remain responsible for their security:- call the endpoint only when your user displays the card;
- never store or log the response.
Who issues the cards?
Who issues the cards?
The issuing entity is not disclosed. Cards are issued through our authorized banking partners under Visa and Mastercard licenses. In the United States, KemyCard operates as a FinCEN-registered Money Services Business.
How do I protect my API keys?
How do I protect my API keys?
Keep them on your server only. They work only from the IP addresses you declare in the dashboard. If a key leaks, revoke it from the dashboard and create a new one. See API keys.
How do I know a webhook really comes from KemyCard?
How do I know a webhook really comes from KemyCard?
Each delivery is signed with HMAC-SHA256 with a secret specific to your endpoint. Verify the signature before processing the event. See Webhooks.