> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anonage.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Open a verification session

> Call this from your **server** (never the browser) — your API key and callback URL stay server-side. Returns an opaque `session_id` + `nonce` you encode into the QR / tap-link.



## OpenAPI

````yaml /api-reference/openapi.json post /api/age-verification/session
openapi: 3.1.0
info:
  title: AnonAge API
  version: 1.0.0
  description: >-
    The AnonAge platform + integration API. Age-verify users without handling
    their identity documents (Verification / API keys / Usage), plus the account
    and KYC endpoints the AnonAge apps use (Auth / Users / KYC).


    All responses share the envelope `{ success, data?, message?, error?,
    errors? }`.
servers:
  - url: https://api.anonage.io
    description: Production (coming soon)
  - url: https://dev1api.anonage.io
    description: Development
security:
  - BearerAuth: []
tags:
  - name: Health
  - name: Auth
    description: Register, sign in, email verification, password reset.
  - name: Users
    description: Profile, password, email, account.
  - name: KYC
    description: Identity verification via Sumsub.
  - name: Verification
    description: Merchant age-verification sessions.
  - name: API keys
    description: Business keys for the integration API.
  - name: Usage
    description: Verification usage reporting.
  - name: Webhooks
    description: Inbound provider webhooks.
paths:
  /api/age-verification/session:
    post:
      tags:
        - Verification
      summary: Open a verification session
      description: >-
        Call this from your **server** (never the browser) — your API key and
        callback URL stay server-side. Returns an opaque `session_id` + `nonce`
        you encode into the QR / tap-link.
      operationId: createSession
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - callback_url
              properties:
                age_required:
                  type: integer
                  enum:
                    - 13
                    - 16
                    - 18
                    - 21
                  default: 18
                callback_url:
                  type: string
                  format: uri
                  description: Must be https in production.
            example:
              age_required: 18
              callback_url: https://shop.example/anonage/callback
      responses:
        '201':
          description: Session created
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  data:
                    $ref: '#/components/schemas/Session'
        '400':
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Error'
      security:
        - ApiKeyAuth: []
components:
  schemas:
    Session:
      type: object
      properties:
        session_id:
          type: string
        nonce:
          type: string
          description: One-time value; encode with session_id into the QR.
        age_required:
          type: integer
        expires_at:
          type: string
          format: date-time
    Error:
      type: object
      properties:
        success:
          type: boolean
          example: false
        error:
          type: string
        errors:
          type: array
          items: {}
  responses:
    Error:
      description: Error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        Account JWT from `/api/auth/login` — used for Users, KYC, key management
        and usage.
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key
      description: Your merchant secret key, e.g. `anonage_sk_…`. Server-side only.

````