CorePass login live in under five minutes.

Yes. A person installs the CorePass application, creates an account and then uses it to sign in anywhere CorePass Connector is integrated, which means the account they create for you is the same one they already use elsewhere. There is nothing for them to remember and nothing for you to reset.

The person's Core ID — their address in the Core ecosystem — and whatever your own application chooses to keep alongside it. There is no password to hash, no email address to confirm and no phone number to hold, because none of those are part of the flow.

The login is four steps and reads in about five minutes: register the client, put the QR snippet in your login page, handle the redirect back, and make your first call. Requesting verified identity data is a second, larger piece of work, because it adds a callback endpoint you have to register and verify.

You name the fields you want, one at a time, from the published vocabulary — a date of birth, a document number, an address, an email address — and the person sees exactly that list on their phone before approving it. Asking for less is both cheaper and far more likely to be approved.

Call the verified-items endpoint before you show anything: it answers with the items the person has verified and the items they have not. If a field your process depends on comes back unverified, tell the person to complete that verification in their CorePass application, because the transfer cannot be started without it.

Every KYC callback carries a Corepass-Signature header — an HMAC-SHA256 over the timestamp and the raw request body, keyed with the webhook secret registered for your domain. KYB deliveries use a separate header and a separate secret, and the values themselves arrive inside an RS256 attestation that you verify against a published key set.

A business has no phone to approve a request, so its members vote and the data is released only when enough of them agree, inside a fixed twenty-four hour window. The values arrive inside a signed attestation rather than beside one, which means there is no way to read a legal name or a registration number without verifying the signature first.

Business field disclosure is prepaid in Swiss francs and priced per field, from registry basics at the lowest tier through documents and screening at the highest. A request reserves its quote when it is created and spends only the fields that were actually released, so a refusal or an expiry gives the money back. Signature requests are free.

A KYC callback is retried on the intervals your deployment is configured with, and the data is held until the retries are exhausted. A KYB delivery is retried for roughly nine hours, and the release can also be pulled from the API while the payload is retained, so an endpoint that was down during the window is not a lost disclosure.