# CorePass Connector

> CorePass Connector is an authentication and authorization service. It gives an
> application passwordless OAuth 2.0 login by QR code — no passwords, email
> addresses or phone numbers are stored — and lets that application request
> verified identity data about a person (KYC) or a business (KYB), released only
> with the owner's approval. A working login is four steps and about five
> minutes.

CorePass Connector is built by CorePass (https://corepass.net/), which provides
decentralized digital identity. A person installs the CorePass application,
verifies their documents once, and then signs in and shares verified fields
anywhere the Connector is integrated.

Key facts:

- Login is OAuth 2.0. The person scans a QR code on desktop or taps a link on
  mobile, and approves the sign-in inside the CorePass application.
- The token an application receives names the person by their Core ID, their
  address in the Core ecosystem. That is the only identifier an integrator is
  obliged to store.
- KYC data is requested by field name. The person approves the named fields on
  their phone, and the values arrive at a callback the integrator registered,
  each with a pepper that allows the value to be re-checked against the registry
  later.
- The KYC approval window is 5 to 15 minutes, set per request.
- KYB data is about a business. Its members vote, the window is a fixed 24
  hours, and the values arrive inside an RS256 attestation rather than beside
  one, so reading a value requires verifying the signature.
- KYB field disclosure is prepaid in Swiss francs and priced per field.
  Signature requests, where a business signs a message the integrator wrote, are
  free and are verified against the business's own wallet contract.
- Callbacks are signed: Corepass-Signature for KYC, Corepass-KYB-Signature for
  KYB. The two use different secrets and different schemes on purpose.
- Gateway hosts in the published documentation: https://auth-develop.corepassdev.eu and
  https://auth-staging.corepassdev.eu for login and KYC, https://api-develop.corepassdev.eu for the KYB
  merchant API.

## Documentation

- [Quickstart](https://connector.corepass.net/docs/quickstart/): Four steps from an empty project to a working passwordless login: register the client, drop in the QR snippet, handle the callback, and make your first verified-data call.
- [Authentication](https://connector.corepass.net/docs/authentication/): How CorePass Connector authenticates a person with OAuth 2.0 and a QR code, what the login page has to contain, and what the token you get back identifies.
- [KYC data transfer](https://connector.corepass.net/docs/kyc/): Check what a person has verified, request the fields you need, follow the transfer through its statuses, and read the values out of the callback.
- [KYB attestations](https://connector.corepass.net/docs/kyb/): Ask a business for verified data, verify the RS256 attestation that carries the values, and ask a business to sign a message you wrote.
- [Webhooks](https://connector.corepass.net/docs/webhooks/): Every callback CorePass Connector sends, how each one is signed, how to verify it without getting it wrong, and what happens when your endpoint is down.
- [API reference](https://connector.corepass.net/docs/api-reference/): Every endpoint on the KYC and KYB APIs in one table, with the hosts, the authentication scheme, the status vocabularies and the closed set of error reasons.

## Pages

- [Home](https://connector.corepass.net/): the product overview and the five-minute quickstart path.
- [Developer hub](https://connector.corepass.net/docs/): the index of the documentation.

## Frequently asked questions

### Do the people using our application need a CorePass account?
Yes. A person installs the CorePass application, creates an account and then uses it to sign in anywhere CorePass Connector is integrated, which means the account they create for you is the same one they already use elsewhere. There is nothing for them to remember and nothing for you to reset.

### What does our application actually store after a login?
The person's Core ID — their address in the Core ecosystem — and whatever your own application chooses to keep alongside it. There is no password to hash, no email address to confirm and no phone number to hold, because none of those are part of the flow.

### How long does the integration really take?
The login is four steps and reads in about five minutes: register the client, put the QR snippet in your login page, handle the redirect back, and make your first call. Requesting verified identity data is a second, larger piece of work, because it adds a callback endpoint you have to register and verify.

### Can we ask for only some identity fields?
You name the fields you want, one at a time, from the published vocabulary — a date of birth, a document number, an address, an email address — and the person sees exactly that list on their phone before approving it. Asking for less is both cheaper and far more likely to be approved.

### What happens if the person has not verified the field we need?
Call the verified-items endpoint before you show anything: it answers with the items the person has verified and the items they have not. If a field your process depends on comes back unverified, tell the person to complete that verification in their CorePass application, because the transfer cannot be started without it.

### How do we know a callback really came from CorePass?
Every KYC callback carries a Corepass-Signature header — an HMAC-SHA256 over the timestamp and the raw request body, keyed with the webhook secret registered for your domain. KYB deliveries use a separate header and a separate secret, and the values themselves arrive inside an RS256 attestation that you verify against a published key set.

### How is KYB different from requesting data about a person?
A business has no phone to approve a request, so its members vote and the data is released only when enough of them agree, inside a fixed twenty-four hour window. The values arrive inside a signed attestation rather than beside one, which means there is no way to read a legal name or a registration number without verifying the signature first.

### What does a KYB request cost?
Business field disclosure is prepaid in Swiss francs and priced per field, from registry basics at the lowest tier through documents and screening at the highest. A request reserves its quote when it is created and spends only the fields that were actually released, so a refusal or an expiry gives the money back. Signature requests are free.

### What happens if our callback endpoint is down?
A KYC callback is retried on the intervals your deployment is configured with, and the data is held until the retries are exhausted. A KYB delivery is retried for roughly nine hours, and the release can also be pulled from the API while the payload is retained, so an endpoint that was down during the window is not a lost disclosure.

## Contact

contact@corepass.net