How Passify works

The end-to-end flow

The diagram below traces a wallet from its first verification through token operations on any integrated platform. Personal data stays with the KYC provider; Passify only ever handles a hash and metadata.

Investor wallet
   │  POST /kyc/start
   ▼
KYC provider (Blockpass)  ──── investor uploads docs + selfie (PII stays here)
   │  webhook: approved
   ▼
Passify  ── SHA-256(result) ──▶  on-chain attestation  (hash + metadata only)
   │
   ├──▶  GET /kyc/status/:pubkey      → any platform reads the proof
   └──▶  POST /token/mint | /transfer → checked against compliance rules

1. Verification

Your platform calls POST /kyc/start with the investor's wallet and a schema. Passify creates a session with the KYC provider and returns a hosted URL. The investor completes verification there. Sensitive documents never reach Passify.

2. Attestation

When the provider approves, it sends Passify a signed webhook. Passify verifies the signature, hashes the result payload with SHA-256, and writes an attestation on-chain containing the wallet key, attester key, schema, expiration, and that hash — and nothing else.

3. Enforcement

When your platform builds a token operation, Passify checks the wallet's attestation against the asset's compliance rules — required schema, allowed jurisdictions, minimum investment, holder caps, and transfer locks. Only if every rule passes does Passify return an unsigned transaction for the user to sign.

4. Reuse

Because the attestation lives on-chain and is keyed to the wallet, a different platform can read the same proof with a single GET /kyc/status/:pubkey call. The investor verifies once and gains access everywhere the attestation is accepted.

Continue with Attestations, or jump to the verify-an-investor guide.