Skip to main content

Credit card–only age verification endpoint

There is now a dedicated /age-verification/perform-credit-card-verification endpoint for running age verification with credit card as the only method, alongside the existing single-method endpoints (ID, AgeKey, ConnectID).

What's new​

  • POST /age-verification/perform-credit-card-verification. Bypasses automatic method selection and verifies the user with credit card only. It takes the same request shape as the other single-method endpoints (jurisdiction, subject, criteria, and optional options.redirectUrl / options.locale) and returns id, url, and shortUrl.
  • Adult (18+) assurance. Credit card verification is an adult assurance signal, not a precise age estimate. It is best suited to jurisdictions where card ownership is restricted to adults.
  • Status and results unchanged. Poll /age-verification/get-status or handle the Verification.Result webhook as usual; results report credit-card as the verification method.

Documentation​

Redirect URL for Automatic age assurance flows

/age-gate/check now accepts a redirect URL that k-ID navigates to once an Automatic age assurance challenge completes. This is intended for top-level browser handoffs (such as a mobile webview that bounces out to k-ID and back) where an iframe-based result handler isn't an option.

What's new​

  • options.playerAgeAssurance.redirectUrl. Pass an http(s) URL or a custom-scheme mobile deeplink (for example myapp://age-gate/return) on /age-gate/check. After the player completes or dismisses the CHALLENGE_AGE_GATE_AGE_ASSURANCE flow, k-ID redirects to that URL with challengeId, productId, sessionId (on PASS), and status (PASS or FAIL) appended as query parameters. Existing query parameters on the URL are preserved.
  • Scope. The option is only honored for CHALLENGE_AGE_GATE_AGE_ASSURANCE. CHALLENGE_PARENTAL_CONSENT is unaffected and continues to return through the trusted-adult flow.
  • Confirm outcomes server-side. The redirect query parameters are a UX hint. Treat the Challenge.StateChange webhook or /challenge/get-status as the source of truth before granting access.

Documentation​

Official k-ID Agent Skills bundle for AI coding agents

k-ID now publishes an official bundle of Agent Skills — small, composable instruction packs that teach an AI coding agent how to integrate k-ID correctly across every jurisdictional regime k-ID supports: COPPA (US), GDPR-Kids (EU), UK AADC, the UK Online Safety Act, Brazil ECA Digital, Australia Online Safety / social media minimum age, and other regional requirements. They work with 35+ AI coding tools, including Claude Code, Cursor, OpenAI Codex, GitHub Copilot, and Gemini CLI.

What's new​

  • Eight focused skills cover the k-ID integration surface end-to-end: age gate, parental consent, age verification and assurance (including verifiedAgeThreshold flows for high-risk permissions), sessions and permissions, webhooks, plus cross-cutting adjuncts for server trust boundary and mobile/native.
  • Cross-jurisdictional by design. The same skills drive integrations for COPPA, GDPR-Kids, UK AADC, UK OSA, Brazil ECA Digital, and Australia Online Safety — jurisdictional behaviour is configured server-side in Compliance Studio, not branched in client code.
  • One-command install for Claude Code via the plugin marketplace; one-line git clone for all other compatible tools.
  • Open standard — the skills follow the Agent Skills specification and work with any compatible agent, not just one vendor.
  • Doc-first contract — skills encode integration patterns and known pitfalls, and link back to this documentation site for API shapes, so they never drift out of sync with the API.

Try it​

Learn more​

AI products quick start guide

A new quick start guide for AI-specific products is now available, alongside an AI permissions category in the Compliance Studio reference.

What's new​

  • AI products quick start. Walks you through end-to-end integration for AI products: configuring AI permissions in Compliance Studio, collecting parental consent, gating AI features, and responding to permission changes.
  • AI permissions category. The permissions reference now lists the AI category with its seven permissions: ai-chat, ai-media-generation, ai-voice-mode, ai-memory, ai-companion-chatbot, ai-media-upload, and ai-model-training.

Documentation​

Rate limits documentation

Default rate limits for the k-ID API and for user-facing age verification and parental consent flows are now documented on a dedicated page.

What's new​

  • API rate limits. Calls to the k-ID API are limited per product: 500 RPS in live mode and 10 RPS in test mode. Requests over the limit return HTTP 429 Too Many Requests.
  • Age verification and parental consent flow rate limits. User-facing flows are limited per product: 100 RPS in live mode and 20 RPS in test mode. When the limit is hit, the user sees an in-flow error asking them to wait and try again (no 429 is surfaced to your server).
  • Requesting an increase. These are defaults. Contact your k-ID representative if your product needs higher capacity.
  • Prelaunch checklists updated. Both the CDK and AgeKit+ prelaunch checklists now reference rate limits explicitly and link to the new page, since live mode ceilings are significantly higher than test mode.

Documentation​

Mock Providers toggle, reorderable verification methods, and COPPA 2026 guide

Today's release adds two new Compliance Studio capabilities and a new developer guide for the COPPA 2026 Rule Amendments.

What's new​

  • Mock Providers / Real Providers toggle. Verification flows running in Test Mode now show a TEST MODE toolbar with a switch between Mock Providers (the default) and Real Providers. Mock Providers presents a built-in simulator that lets you submit personas (Adult, Teen, Child, or Passes / Fails Age Check), enter a custom age range or date of birth, and simulate Inconclusive or Fraudulent failures. Submissions flow through the same server path as real providers, so webhooks, sessions, and DOM events behave identically.
  • Verification method ordering. Each enabled method on the Assurance and Verification tab now has a drag handle. Drag methods to change the order shown to users in the Family Connect widget, use Reset to default order to restore the k-ID default, and apply different orders per-market via Market Specific Rules.
  • New Compliance Guides section. A new top-level docs section for compliance playbooks launches today with its first entry: 2026 COPPA Rule Amendments. The guide walks COPPA-subject operators through the configuration updates needed before the April 22, 2026 enforcement date.

Documentation​

Configure verification methods as fallbacks

You can now configure each verification method listed under the Assurance and Verification tab as Fallback only, in addition to enabled or disabled.

What's new​

  • Fallback only: A method with this setting is offered only after the user has attempted another verification method and that attempt didn't produce an age signal (no conclusive age determination). It won't appear in the initial list of methods.
  • Why it helps: You can keep a stronger or alternative method in reserve for cases where a lighter method couldn't reach a verification outcome, without showing every option up front.

Documentation​

  • Adult verification: Assurance and Verification tab, where you enable, disable, or set Fallback only on each verification method
  • Verification methods: overview of verification behavior, including a callout on Fallback only

Short URL field in age verification API responses

Age verification creation responses (from endpoints such as POST /age-verification/perform-access-age-verification) now include shortUrl in addition to id and url.

What's new​

  • Compact link: shortUrl is a shorter link that redirects to the same verification experience as the full url. Use it when a long query string is a poor fit, for example for QR codes or when the user completes verification on another device.
  • Full URL unchanged: The session JWT remains on the full url (token query parameter). Don't try to shorten or rebuild that URL yourself.
  • Opaque value: Treat shortUrl as an opaque string. Display or encode it as returned, and don't rely on a fixed path or query layout, which might change in the future.

Learn more​

Platform age signals documentation

We've published end-to-end documentation for platform age signals: how Apple iOS, Google Play, Xbox, Meta Horizon, and k-ID age data flows into k-ID, when the age gate can be skipped, and how verified versus unverified signals interact with high-risk permissions and age assurance.

What's New​

CDK — Platform age signals​

  • Platform age signals — Quick integration paths, API map, recommended request sequence, how POST /age-gate/check uses a platform signal, supported platforms and verified declaration types, and verified versus unverified signal behavior.
  • Platform signal details — Per-platform field shapes, how to obtain each native signal, endpoint-by-endpoint notes (get-requirements, check, get-default-permissions, session/get, get-platform-age-range, session/upgrade), validation, age conflicts, and k-id signal rules.

API reference (OpenAPI)​

Descriptions for session upgrade, AgeVerification, and platformAgeSignal now use verified platform signal wording consistently with the docs above.

Documentation​

Browser and device compatibility

We've added a new Browser and device compatibility page to the docs so you can quickly check which browsers and devices are supported for our age verification flows.

What's New​

Browser and device compatibility​

The new page lists minimum browser versions for desktop and mobile, plus requirements for embedded browsers (ASWebAuthenticationSession on iOS, Chrome Custom Tabs on Android). This consolidates the combined compatibility requirements across our verification providers into a single reference.

New documentation​