> For the complete documentation index, see [llms.txt](https://authento.gitbook.io/authento-api/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://authento.gitbook.io/authento-api/integration-guidance/account-based-verification.md).

# Account-Based Verification

In the account-based verification flow, users are identified by server-generated unique identification strings. You should also manage your own user database, and keep it updated by fetching the latest user information using the Authento API upon receiving webhook notifications.

<figure><img src="/files/oJspC8Hp8exmRFoqJhwN" alt=""><figcaption><p>Account-based verification</p></figcaption></figure>

## Steps

1. Send us the list of IPs which should be granted dashboard/API access.
2. Configure the following on the [Authento Dashboard](https://dashboard.authento.io) under the *Settings* tab:
   * API key/secret
   * Webhook targetURL/secret
   * JWT secret
3. \[Backend] Set up handlers for verification token requests.
4. \[Backend] Set up handlers for verification webhooks.

## Verification Tokens

Verification tokens are JSON web tokens (JWT) which contains information needed to initialize the account-based verification flows. They should be signed with the JWT secret configured on the Authento dashboard, and contain the following fields:

<table><thead><tr><th width="99.33333333333331">Key</th><th width="157">Name</th><th>Description</th></tr></thead><tbody><tr><td>iss</td><td>Issuer</td><td>Domain name, obtained from <a href="https://dashboard.authento.io/">Authento Dashboard</a>.</td></tr><tr><td>sub</td><td>Subject</td><td>User Identifier; server-generated string unique to each user. This is used to associate users with their verification results.</td></tr><tr><td>aud</td><td>Audience</td><td>This should always be "Authento".</td></tr><tr><td>iat</td><td>Issued at</td><td>Unix timestamp in seconds when token is issued.</td></tr><tr><td>vt</td><td>Verification type</td><td>Either "BASIC" or "POA"</td></tr><tr><td>ut</td><td>User type</td><td>(Optional) Either "INDIVIDUAL" or "CORPORATE</td></tr><tr><td>lang</td><td>Language</td><td>(Optional) ISO 639-1 language code, defaults to "en"</td></tr></tbody></table>

{% hint style="warning" %}
The user identifier assigned to each of your user must be persistent and unique.
{% endhint %}

{% hint style="info" %}
The user type value, if provided, affects the following:

* Default user type - For new Authento users, their user type will be automatically set to the value specified in the token.
* Required user type - For existing Authento users, verification will only proceed if the user type is equal to the value specified in the token.
  {% endhint %}

Verification tokens can be easily generated using standard JWT libraries. Here are some examples:

{% tabs %}
{% tab title="Node.js" %}
{% code lineNumbers="true" %}

```javascript
import jwt from "jsonwebtoken";

const token = jwt.sign(
  {
    iss: CLIENT_NAME, // Obtained from Authento dashboard
    sub: USER_IDENTIFIER, // userIdentifier: identification string unique to each user
    aud: "Authento", // This should always be "Authento"
    ut: "INDIVIDUAL", // userType: "INDIVIDUA" | "CORPORATE"
    vt: "BASIC", // verificationType: "BASIC" | "POA"
    lang: "en", // (Optional) ISO 639-1 language code
  },
  AUTHENTO_JWT_SECRET // Obtained from Authento dashboard
);
```

{% endcode %}
{% endtab %}

{% tab title="Python" %}
{% code lineNumbers="true" %}

```python
import jwt

encoded = jwt.encode(
  {
    "iss": CLIENT_NAME, # Obtained from Authento dashboard
    "sub": USER_IDENTIFIER, # userIdentifier: identification string unique to each user
    "aud": "Authento", # This should always be "Authento"
    "ut": "INDIVIDUAL", # userType: "INDIVIDUA" | "CORPORATE"
    "vt": "BASIC", # verificationType: "BASIC" | "POA"
    "lang": "en", # (Optional) ISO 639-1 language code
  },
  AUTHENTO_JWT_SECRET, # Obtained from Authento dashboard, 
  algorithm="HS256"
)
```

{% endcode %}
{% endtab %}
{% endtabs %}

A list of Libraries for signing/verifying JWTs can be found [here](https://jwt.io/libraries).

Backend examples for verification token generation can be found [here](https://github.com/Authento/usage-examples/blob/main/account-based/src/app/api/jwt/route.ts).

To initialize a verification on the frontend using the generated token, you can either:

* (Recommended) Make use of the [useTokenVerifyPopup](/authento-api/authento-react/usetokenverifypopup.md) hook from the Authento-react library as shown in this [example](https://github.com/Authento/usage-examples/blob/main/account-based/src/layouts/Home/Home.tsx)
* Open a popup and redirect the user to app.authento.io/verify/token?jwt={generatedToken}

## Webhooks Handling

In account-based verification, webhooks are sent to a preconfigured target URL upon occurrence of events such as initialization or completion of verifications. You can then fetch the latest user information from the appropriate endpoint and update your user records.

For more information, please refer to the [webhooks](/authento-api/integration-guidance/webhooks.md) section.