Verification links

Send a customer a link to verify, instead of integrating the login flow. They approve in the IDfier app and you read the verified result.

The customer opens the link on idfier.com, approves in the IDfier app (or their EU Digital Identity Wallet), and you read the result. Each link uses one verification credit. The endpoints use the same clientid / clientsecret headers as the rest of the Identity API.

Create a link

curl -X POST https://api.idfier.com/api/v3/business/links \
  -H "clientid: $IDFIER_CLIENT_ID" \
  -H "clientsecret: $IDFIER_CLIENT_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "recipientName": "Anna Lindqvist",
    "recipientEmail": "anna@example.com",
    "message": "Please verify before we sign the lease.",
    "scopes": ["fullname", "ageOver18"],
    "expiresInDays": 7
  }'

Field	Description
`recipientName`	Optional, shown on the link page and in the email (max 200)
`recipientEmail`	Optional. If set, IDfier emails the link unless `sendEmail` is `false`
`message`	Optional message to the customer (max 1000)
`scopes`	What to verify. Defaults to all your scopes; must be among them. Age checks are allowed if you have any age scope, `age` or `dateOfBirth`
`expiresInDays`	1–30, default 7
`sendEmail`	Default `true`
`createdBy`	Optional, your own note of who created it

201 Created:

{
  "status": 100,
  "data": {
    "id": "…",
    "url": "https://www.idfier.com/v/…",
    "expiresAt": "2026-11-07T10:00:00.000Z",
    "emailSent": true
  }
}

The url is only returned here and on resend: IDfier stores only a hash of it. With no credits left the response is 402; scopes your business may not use give 400.

Read the result

Poll GET /business/links/:id until the status is final:

{
  "status": 100,
  "data": {
    "id": "…",
    "status": "approved",
    "scopes": ["fullname", "ageOver18"],
    "method": "idfier",
    "result": { "id": "u_3f9a…", "fullname": "Anna Lindqvist", "ageOver18": true }
  }
}

result is set once the customer has approved. It has exactly the requested scopes plus an id unique to your business (see Scopes). method says how they verified: idfier or eudi_wallet.

Status	Meaning
`sent`	Created, not opened yet
`opened`	The customer opened the link page
`approved`	The customer approved; `result` is available
`denied`	The customer declined
`cancelled`	You cancelled it
`expired`	Not completed before `expiresAt`

To list links, GET /business/links?limit=50 returns { links, nextBefore }, newest first; pass nextBefore as before for the next page.

Cancel, resend, delete

POST /business/links/:id/cancel closes an open link.
POST /business/links/:id/resend, with an optional { "expiresInDays": 7 }, issues a new URL (the old one stops working), extends the expiry and emails it again if there is a recipientEmail. Works on sent, opened and expired links.
DELETE /business/links/:id deletes the link and its record of the customer.

Cancelling or resending a link in a state that doesn't allow it (for example an approved link) returns 409; a link that doesn't exist or isn't yours returns 404.

The link page

https://www.idfier.com/v/<token> shows who is asking and what will be shared. On a computer it shows a QR code to scan with the IDfier app; on a phone it opens the app. When EU wallets are enabled it also offers "Or use your EU Digital Identity Wallet".

Create a linkCopy Anchor Link

Read the resultCopy Anchor Link

Cancel, resend, deleteCopy Anchor Link

The link pageCopy Anchor Link

On this page

Create a link

Read the result

Cancel, resend, delete

The link page