---
title: "Get Onboarding SDK Token"
method: GET
path: "/verify/get_onboarding_sdk_token/{session_id}"
tags: ["SDK"]
---

# Get Onboarding SDK Token

`GET /verify/get_onboarding_sdk_token/{session_id}`

## Request

- Base URL: `https://api-sandbox.aiprise.com/api/v1`
- URL: `https://api-sandbox.aiprise.com/api/v1/verify/get_onboarding_sdk_token/{session_id}`
- Auth: API key in header `X-API-KEY`
- TypeScript: <https://skmtc.dev/aiprise/apis/aiprise-apis/docs/verify/get_onboarding_sdk_token/:session_id/get.ts> (a function with typed inputs; its response is checked against the schema)

Get an onboarding SDK token for a verification session you want to resume without OTP. (Only for KYB sessions)

**Server-side only.** Call this from your backend. The `X-API-KEY` it requires is a company-wide secret that authenticates every AiPrise API call you make, so it must never be shipped to a browser, embedded in frontend code, or passed through an end user's device - anyone who obtains it can act as your company across the entire API.

The minted token is what crosses that boundary, not the key: it is scoped to this one verification session and expires 5 minutes after it is issued, so a token that leaks exposes a single session for a few minutes rather than your whole account. Mint it on your server at the moment you are about to start the SDK, and hand the SDK only the token.

## Path parameters

- `session_id` string, required

## Response `200`

Successful operation

- object
  - `onboarding_sdk_token` string: Short-lived JWT (HS256) scoped to this one verification session. Expires 5 minutes after it is issued, so mint it when you are about to hand it to the SDK. Its payload carries `company_id`, `verification_session_id`, `type` (always `onboarding_sdk`), `iat` and `exp`, but treat the token as opaque - the SDK passes it back to AiPrise as-is.
  - `success` boolean: Whether the operation was successful

## Other responses

- `400`: Bad Request - the session does not exist, or it belongs to another company. Both cases return the same response so that this endpoint cannot be used to probe for valid session IDs.
- `401`: Unauthorized - missing API key
- `403`: Forbidden - the company's trial period has expired, or the API key is not associated with a company.

## Changes

- **2026-11-03** `74fc7a5199fb`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/aiprise/apis/aiprise-apis/changes/verify/get_onboarding_sdk_token/:session_id/get.md)

---

[API](https://skmtc.dev/aiprise/apis/aiprise-apis.md) - [All operations](https://skmtc.dev/aiprise/apis/aiprise-apis/llms.txt) - [OpenAPI document](https://skmtc.dev/aiprise/apis/aiprise-apis/revisions/74fc7a5199fb?raw)