> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rheon.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Get a verification token

> POST /card/kyc-token - an access token for the on-ramp's own identity flow.

Returns a short-lived access token for the on-ramp's identity widget. The buyer
verifies inside their flow, not ours - documents and selfies never touch Rheon, and
never touch you.

Use this when [`/card/purchase`](/api-reference/card-purchase) comes back with
`status: "pending"`.

## Request

<ParamField body="email" type="string" required>
  The buyer's email. Verification is keyed to it, so use the same address you pass
  to `/card/purchase`.
</ParamField>

## Response

<ResponseField name="accessToken" type="string">
  Token to hand to the identity widget. Short-lived - fetch it when you are about to
  mount the widget, not in advance.
</ResponseField>

<ResponseField name="applicantId" type="string">
  The applicant's identifier in the identity provider's system.
</ResponseField>

<Note>
  After the buyer submits, verification is **not instant**. `/card/purchase` keeps
  returning `pending` while it is under review, which is a normal state and not an
  error. Poll it rather than blocking the buyer on a spinner.
</Note>

<RequestExample>
  ```bash cURL theme={null}
  curl -X POST "$RHEON_API/card/kyc-token" \
    -H "Content-Type: application/json" \
    -d '{ "email": "buyer@example.com" }'
  ```
</RequestExample>

<ResponseExample>
  ```json 200 theme={null}
  {
    "accessToken": "_act-sbx-jwt-...",
    "applicantId": "app_1"
  }
  ```
</ResponseExample>

## Errors

| HTTP | `code`            | When                                         |
| ---- | ----------------- | -------------------------------------------- |
| 400  | `invalid_request` | Missing or malformed email.                  |
| 429  | `rate_limited`    | Over the rate limit (5 requests / 10s / IP). |
| 502  | `upstream_error`  | The on-ramp is unavailable.                  |
| 500  | `internal`        | Unexpected server error.                     |