v2.accounts

Create an embedded verification session (live platform key)

Create a fresh short-lived session for the official embedded account-onboarding component inside the platform application. Live platform key and its own connected account only; provider controller.requirement_collection must be application. Only onboarding is enabled, external account collection is disabled and Stripe user authentication is disabled for eligible accounts. No automatic redirect or change to POST /accounts. Platform must authenticate and authorize the seller on its backend (2FA recommended), protect session issuance against CSRF and never put its Cooud API key in the browser. Return client_secret only to that authenticated seller over HTTPS; never log, persist, put in URLs or share it. No cache or replay. Official SDK assets and legally required provider notices may remain visible: this is embedded verification, not a guarantee of invisible Stripe/Cooud branding. Exit does not mean approval; retrieve account status (up to 60-second cache) or use cooud.account.updated. POST /files does not complete proof_of_liveness. Call SDK logout when the seller logs out or changes account.

post/accounts/{id}/onboarding_session

Request

  • Base URL: https://api.cooud.com/v2
  • URL: https://api.cooud.com/v2/accounts/{id}/onboarding_session
  • Auth: HTTP bearer

Path parameters

idstring required

Connected account id (cooud_acct_<ULID> — the seller's store).

Headers

Cooud-Compat-Datestring date required

Required per-request compat-date. Format: ISO calendar date YYYY-MM-DD. Merchants pinned to an older date have their request and response transformed by every gate whose appliesAfter is strictly greater than this date.

Request body

object required

Response

Fresh scoped browser session. Cache-Control: no-store. Session issuance and component exit do not approve or update the account. For a Cooud LLC account (platforms Cooud enabled for it) the session is of the seller's Cooud LLC (Stripe Express) account, with the Cooud LLC publishable key; the seller authenticates with Stripe and gives the bank account there.

object'account_onboarding_session' required
accountstring required
client_secretstring required

Short-lived provider component credential. Only deliver over HTTPS to the authenticated account owner. Do not log, persist or include in URLs.

publishable_keystring required

Public provider key for the official browser SDK. This is not the secret Cooud platform key.

expires_atinteger required

Unix expiry. Expired sessions must be freshly issued by the authenticated backend.

component'account-onboarding' required
livemodetrue required
request_idstring required

Changes

No recorded changes to this operation across all 1 revision of this API.