Skip to main content

Short URL field in age verification API responses

Age verification creation responses (from endpoints such as POST /age-verification/perform-access-age-verification) now include shortUrl in addition to id and url.

What's new​

  • Compact link: shortUrl is a shorter link that redirects to the same verification experience as the full url. Use it when a long query string is a poor fit, for example for QR codes or when the user completes verification on another device.
  • Full URL unchanged: The session JWT remains on the full url (token query parameter). Don't try to shorten or rebuild that URL yourself.
  • Opaque value: Treat shortUrl as an opaque string. Display or encode it as returned, and don't rely on a fixed path or query layout, which might change in the future.

Learn more​

Platform age signals documentation

We've published end-to-end documentation for platform age signals: how Apple iOS, Google Play, Xbox, Meta Horizon, and k-ID age data flows into k-ID, when the age gate can be skipped, and how verified versus unverified signals interact with high-risk permissions and age assurance.

What's New​

CDK — Platform age signals​

  • Platform age signals — Quick integration paths, API map, recommended request sequence, how POST /age-gate/check uses a platform signal, supported platforms and verified declaration types, and verified versus unverified signal behavior.
  • Platform signal details — Per-platform field shapes, how to obtain each native signal, endpoint-by-endpoint notes (get-requirements, check, get-default-permissions, session/get, get-platform-age-range, session/upgrade), validation, age conflicts, and k-id signal rules.

API reference (OpenAPI)​

Descriptions for session upgrade, AgeVerification, and platformAgeSignal now use verified platform signal wording consistently with the docs above.

Documentation​

Browser and device compatibility

We've added a new Browser and device compatibility page to the docs so you can quickly check which browsers and devices are supported for our age verification flows.

What's New​

Browser and device compatibility​

The new page lists minimum browser versions for desktop and mobile, plus requirements for embedded browsers (ASWebAuthenticationSession on iOS, Chrome Custom Tabs on Android). This consolidates the combined compatibility requirements across our verification providers into a single reference.

New documentation​

Account System Product

We've released Account System Product, a capability that lets your organization's central account or platform product create authentication challenges and sessions on behalf of other products in your organization using a single API key and an optional header.

What's New​

Account System Product​

When a product is enabled as an Account System Product in Compliance Studio, you can call certain k-ID APIs on behalf of other (non–account system) products in the same organization by sending the Kid-Target-Product-Id header with the target product's ID. You use your Account System Product's API key; no need to manage or rotate keys per target product.

Supported endpoints:

Parents see only the target product's configuration (notices, permissions, branding). Both the account system product and the target product receive webhooks for each event, with onBehalfOfProductId and initiatedByProductId so you can attribute cross-product flows.

Account System Product works with multi-product approval: you can set the Account System Product as an essential product of a target so the parent approves both in one flow.

Documentation​

Additional legal links and Check age gate options

We've documented additional legal links in Developer Details and the new options parameter on the Check age gate API so you can show platform-specific legal documents (e.g., Xbox, PlayStation, Steam) in consent flows.

What's New​

In Compliance Studio, on the Developer Details tab for a product, you can now add optional Additional legal links that appear in consent flows:

  • Title and Link: Localized display title and URL (same language options as your main legal documents).
  • Variant ID: Identifier used when calling the Check age gate API (e.g., xbox-tos, playstation-privacy-policy). Required if Always display is off.
  • Always display: When on (default), the link is always shown in consent flows. When off, the link is only shown when your game calls the age-gate API with the matching variant ID in options.

Use these when your game is distributed on multiple platforms and each platform requires different legal document URLs.

Check age gate API — options parameter​

The POST /api/v1/age-gate/check request body now supports an optional options object:

  • termsOfServiceDocument: Variant ID for Terms of Service (must match a configured additional legal link).
  • privacyPolicyDocument: Variant ID for Privacy Policy (must match a configured additional legal link).
  • additionalLegalLinks: Array of variant IDs for extra legal documents to display with ToS and Privacy Policy (each must match a configured additional legal link).

When a challenge is created, the consent screen shows the requested legal links instead of the default product Privacy Policy and Terms of Service.

Documentation​

Verification URL validity and get-status documentation

We've updated the age verification docs to cover URL validity, expired URLs, and status checks.

What's New​

  • URL validity: The verification URL is valid for 2 weeks. The expiry is in the JWT token query parameter—use the standard exp claim to check if a URL is still valid.
  • Expired URLs: Call /age-verification/get-status with the saved verification ID. If not found, create a new verification.
  • Status without the URL: Use get-status with the verification ID to check status anytime (e.g. after URL expiry or if the webhook was missed).
  • Retention: Verifications that stay PENDING for over 2 weeks are deleted and no longer returned by get-status.

Updated documentation​

Age Gate Widget Redirect URL Support

We've added support for redirectUrl as an optional parameter to the age gate widget endpoint.

What's New​

Age Gate Widget API Update​

The /widget/generate-age-gate-url endpoint now supports an optional redirectUrl parameter within the options object. This allows you to specify a URL to redirect to after the age gate widget completes, similar to the end-to-end widget endpoint.

The redirectUrl parameter supports HTTP/HTTPS URLs or mobile deeplinks with custom protocol schemes.

Updated API​

Verification Documentation Updates

We've updated the verification documentation to improve method field descriptions and clarify guidance.

What's New​

Verification Result Documentation​

Updated the Verification.Result webhook documentation:

  • ageCategory guidance: Clarified that ageCategory is always present for PASS status and should be used for access control decisions rather than raw age values
  • Method field updates:
    • Removed self-confirmation and email-confirmation from the methods field list
    • Updated age-estimation-scan description to indicate it's a facial age estimation scan that returns an age range (no DOB)

Updated Documentation​

Widget.ExitReview Clarification and API Updates

We've clarified when to close widget UI for age verification and VPC flows, and added redirectUrl support to the MegaWidgetOptions schema.

What's New​

Widget.ExitReview Clarification​

We've updated the documentation to clarify that Widget.ExitReview is the signal that should determine when to close the UI for age verification and VPC flows.

Updated documentation:

  • Age verification guide - Added guidance on listening for Widget.ExitReview to close the verification UI
  • VPC guide - Added guidance on listening for Widget.ExitReview to close the VPC widget UI
  • CDK embedded flow - Added guidance on listening for Widget.ExitReview to close the widget UI

All language versions (English, Japanese, Simplified Chinese, and Korean) have been updated with this clarification.

API Updates​

redirectUrl in MegaWidgetOptions​

The MegaWidgetOptions schema now includes redirectUrl support, consistent with age verification request schemas. This allows you to specify a redirect URL when using the end-to-end widget.

Updated schemas:

  • MegaWidgetOptions now includes redirectUrl field with reference to #/components/schemas/RedirectUrl

This change is available in all OpenAPI specification files (English, Japanese, Simplified Chinese, and Korean).

Documentation Improvements​

Product Image Specifications​

Added recommended aspect ratios and resolutions for product images in Compliance Studio:

  • Logo: 1:1 (square), 512×512px
  • Banner: 3:1 (wide), 2430×810px

ageCategory Now Included in FAIL Status Webhook Events

We've updated the Verification.Result webhook event to include the ageCategory field in FAIL status events when age data is available.

What's New​

ageCategory in FAIL Status Events​

The ageCategory field is now included in Verification.Result webhook events for FAIL status when:

  • failureReason is age-criteria-not-met
  • Age data is available (both age.low and age.high are present)

This provides more complete information about the user's age category even when verification fails due to age criteria not being met, enabling better analytics and logging while maintaining clear access control boundaries.

Updated Documentation​

The Verification.Result documentation has been updated to reflect this change:

  • Fields table: Updated description to clarify when ageCategory is present for FAIL status
  • Key differences table: Clarified when ageCategory is present for webhook events vs API endpoint
  • FAIL status field presence rules: Updated to show ageCategory as "Sometimes included" with specific conditions
  • Complete field matrix: Updated to show ageCategory as "sometimes²" for FAIL status in webhooks
  • Example payloads: Added ageCategory to the FAIL status example to demonstrate the new behavior
  • Implementation checklist: Updated guidance for handling ageCategory in FAIL status
  • Implementation notes: Clarified the behavior of ageCategory for both PASS and FAIL statuses

Important Notes​

  • Access control: Even when ageCategory is present in FAIL status events, it should never be used for access control decisions. Always use the status field to determine access.
  • Consistency: This update applies to both webhook events and API endpoint responses
  • Language support: All language versions (English, Japanese, Simplified Chinese, and Korean) have been updated

Next Steps​

  • Review the updated Verification.Result documentation
  • Update your integration to handle ageCategory in FAIL status events if needed
  • Remember: Never use ageCategory for access control when status is FAIL, even if the field is present. Use it only for analytics, logging, or informational purposes.