The Partner API lets you provision end-users, run identity verification (KYC), and query account status — all from your own backend, using your own branded experience.
End User → Your App → Your Backend → Qash Partner API
↑
X-Api-Key + X-Api-Secret
Base URL
| Environment | URL |
|---|
| Production | https://api.qash.ai |
| Local (api-gateway) | http://localhost:8080 |
/api/v1/partner.
Authentication
Every request requires both headers:
X-Api-Key: qash_key_live_xxxxx
X-Api-Secret: qash_secret_live_xxxxx
X-Api-Secret is shown only once at generation time. If lost, revoke the key and create a new pair from Qash Dashboard → Settings → API Keys.
Endpoints
| Method | Endpoint | Description |
|---|
POST | /users | Register a new end-user |
POST | /kyc | Start identity verification for a user |
GET | /users/:userId | Get full details of a user |
GET | /users | List your users with filters and pagination |
POST | /auth/token | Exchange a userId for a Qash user JWT |
POST | /auth/login | Deprecated — Exchange a Privy token for a QASH JWT |
Onboarding flow
User status lifecycle
| Status | Description | Can operate? |
|---|
pending | Registered, KYC not yet completed | No |
active | KYC approved, fully operational | Yes |
suspended | Temporarily suspended | No |
banned | Permanently blocked | No |
Data isolation
Your API key scopes all queries — you can only see and manage users you created. A 404 on any user endpoint means either the user doesn’t exist or belongs to a different partner. There is no way to access another partner’s users.
Credential rotation
If your X-Api-Secret is compromised:
- Go to Qash Dashboard → Settings → API Keys
- Revoke the current key
- Generate a new key pair
- Update your backend with the new credentials
Common errors
| HTTP status | Error | Cause |
|---|
400 | Validation message | Missing required field or invalid format |
401 | Invalid partner credentials | Wrong or missing X-Api-Key / X-Api-Secret |
404 | User not found | User doesn’t exist or belongs to another partner |
409 | KYC already in progress | KYC was already initiated for this user |
503 | — | Authentication service unavailable |