Quickstart

You’ll go from no account → your first verified agent + ContraToken in under 5 minutes.

What you’ll need

An email address.
~5 minutes.
(Optional) A USDC-funded wallet — if you want to test the agentic (x402) entrypoint.

# Register
curl -X POST https://auth.contra.id/v1/programmatic/register \
  -H "Content-Type: application/json" \
  -d '{"email": "you@yourco.com", "password": "MyStr0ng!Pass"}'

# Check your email for the 6-character OTP, then:
curl -X POST https://auth.contra.id/v1/programmatic/verify-email \
  -H "Content-Type: application/json" \
  -d '{"email": "you@yourco.com", "code": "A3K9F2"}'
# → response.application.api_key  ← your x-api-key

Save the api_key — every /v1/* call below sends it as x-api-key.

Step 2 · Pick a verification workflow

curl https://identity.contra.id/v1/workflows \
  -H "x-api-key: $CONTRA_KEY"

You’ll see the 5 built-in workflows:

`workflow_id`	Use
`standard_kyc`	Document Verification + AML
`enhanced_kyc`	+ Biometric KYC + phone
`institutional_kyc`	+ Address + email
`aml_only`	AML screening only
`kyb`	Business Verification + AML

Or compose your own with POST /v1/workflows.

Step 3 · Create a session for your user

curl -X POST https://identity.contra.id/v1/sessions \
  -H "x-api-key: $CONTRA_KEY" -H "Content-Type: application/json" \
  -d '{
    "workflow_id": "enhanced_kyc",
    "vendor_data": "user-abc-123",
    "callback": "https://yourapp.com/contra/webhook"
  }'
# → { "session_id": "...", "url": "https://verify.contra.id/...", "status": "pending" }

Send the user to url. They scan their ID, take a selfie, done.

Step 4 · Get the decision (+ ContraToken)

curl https://identity.contra.id/v1/sessions/$SESSION_ID/decision \
  -H "x-api-key: $CONTRA_KEY"

When the user is approved:

{
  "session_id": "sess_b3f1c2a4",
  "status": "approved",
  "compliance_level": "enhanced",
  "contra_token": "eyJhbGciOiJIUzI1NiI...",
  "node_results": {
    "document_verification": { "status": "passed" },
    "biometric_kyc":         { "status": "passed" },
    "aml_screening":         { "status": "passed" }
  }
}

The ContraToken is a signed JWT carrying the compliance attestation. No PII inside.

Step 5 · Verify the token on any inbound agent request

import { contra } from '@contra/sdk'
app.use(contra.middleware())
app.post('/api/pay', (req, res) => {
  // req.agent → { complianceLevel, jurisdiction, humanBinding, riskScore }
  if (req.agent.complianceLevel < 'enhanced') return res.status(403).end()
  // proceed
})

Workflows · concepts

Compose your own verification recipes — required vs optional nodes, thresholds, retries.

x402 + A2A

The agentic-native entrypoint — pay-per-call USDC, wallet-as-tenant, no signup.

Overview

Core Concepts

What you’ll need

Step 2 · Pick a verification workflow

Step 3 · Create a session for your user

Step 4 · Get the decision (+ ContraToken)

Step 5 · Verify the token on any inbound agent request

Next

Workflows · concepts

x402 + A2A

​What you’ll need

​Step 1 · Sign up + get an API key

​Step 2 · Pick a verification workflow

​Step 3 · Create a session for your user

​Step 4 · Get the decision (+ ContraToken)

​Step 5 · Verify the token on any inbound agent request

​Next

Workflows · concepts

x402 + A2A

What you’ll need

Step 1 · Sign up + get an API key

Step 2 · Pick a verification workflow

Step 3 · Create a session for your user

Step 4 · Get the decision (+ ContraToken)

Step 5 · Verify the token on any inbound agent request

Next