Cashfree Secure ID — Identity Verification & KYC

Use POST /bank-account/sync for real-time bank account verification, which returns account_status, name_at_bank, and a name-match score in the HTTP response. For bulk or high-volume checks, use the async endpoint and capture results via webhook or polling.

Penny drop (BAV) deposits ₹1 into the account to validate a beneficiary before payout. Reverse penny drop has the account holder send ₹1 from their own account via UPI, and is meant for user self-verification during onboarding, not beneficiary validation.

Compute an HMAC-SHA256 of the webhook timestamp concatenated with the raw request body using your client secret, then base64-encode it and compare with the x-webhook-signature header. Always verify signatures before processing events.

Yes, via a flow of verify-account, creating a consent URL valid for 10 minutes, user OTP consent, and fetching documents like Aadhaar, PAN, or DL. Note that sandbox DigiLocker requires real Aadhaar numbers, and status arrives via webhook.

No, Secure ID API calls must be routed through your backend because they require the X-Client-Secret header, which must never be exposed client-side. Only specific SDKs like DigiLocker React Native, Video KYC, and 1-Click Onboarding run on the frontend.

The async BAV endpoint returns only an acknowledgement with a reference_id, not the verification outcome. You must implement a webhook handler for BANK_ACCOUNT_VERIFICATION events or poll GET /bank-account with the reference_id to get the final account_status.