Player KYC

JPY deposits require the player to be registered once. A deposit for an unregistered player fails with 502 and {"code": "KYC_NOT_REGISTERED"}.

Registration can take up to 30 minutes. Deposits are accepted when the status is REGISTERED.

Register

POST /kyc-register

The path uses a hyphen, not a slash.

Field	Required	Notes
`gateway`	yes today	The KYC channel value from InsPay onboarding. Coming soon`gateway` becomes optional. InsPay routes by currency and your account setup. Values you already send stay accepted.
`playerId`	yes	Your player id
`userName`	yes	Player name in full-width katakana
`currency`	yes	`JPY`
`callbackUrl`	no	Receives the final KYC status
`timestamp`, `nonce`	yes	See signing

kyc-register.json


{
  "gateway": "YOUR_KYC_CHANNEL",
  "playerId": "player_abc123",
  "userName": "ヤマダ タロウ",
  "currency": "JPY",
  "callbackUrl": "https://merchant.example.com/callbacks/kyc",
  "timestamp": 1791729147,
  "nonce": "d4e5f6a7"
}

kyc-register.sh


API_KEY="YOUR_API_KEY"
SECRET_KEY="YOUR_SECRET_KEY"
BASE_URL="https://api-sandbox.inspay.dev/merchant"
 
CANONICAL='{"callbackUrl":"https://merchant.example.com/callbacks/kyc","currency":"JPY","gateway":"YOUR_KYC_CHANNEL","nonce":"d4e5f6a7","playerId":"player_abc123","timestamp":"1791729147","userName":"\u30e4\u30de\u30c0 \u30bf\u30ed\u30a6"}'
SIG=$(printf '%s' "$CANONICAL" | openssl dgst -sha256 -hmac "$SECRET_KEY" -hex | awk '{print $NF}')
 
curl -sS -X POST "$BASE_URL/kyc-register" \
  -H "Content-Type: application/json" \
  -H "x-api-key: $API_KEY" \
  -H "x-signature: $SIG" \
  --data-binary "$CANONICAL"

kyc-register.mjs


import crypto from "node:crypto";
 
const API_KEY = "YOUR_API_KEY";
const SECRET_KEY = "YOUR_SECRET_KEY";
const BASE_URL = "https://api-sandbox.inspay.dev/merchant";
 
function jsonString(value) {
  let out = '"';
  for (const ch of String(value)) {
    const cp = ch.codePointAt(0);
    if (ch === '"') out += '\\"';
    else if (ch === "\\") out += "\\\\";
    else if (ch === "\b") out += "\\b";
    else if (ch === "\f") out += "\\f";
    else if (ch === "\n") out += "\\n";
    else if (ch === "\r") out += "\\r";
    else if (ch === "\t") out += "\\t";
    else if (cp < 0x20 || cp > 0x7e) {
      if (cp > 0xffff) {
        const adj = cp - 0x10000;
        const hi = 0xd800 + (adj >> 10);
        const lo = 0xdc00 + (adj & 0x3ff);
        out += "\\u" + hi.toString(16).padStart(4, "0");
        out += "\\u" + lo.toString(16).padStart(4, "0");
      } else {
        out += "\\u" + cp.toString(16).padStart(4, "0");
      }
    } else out += ch;
  }
  return out + '"';
}
 
const body = {
  gateway: "YOUR_KYC_CHANNEL",
  playerId: "player_abc123",
  userName: "ヤマダ タロウ",
  currency: "JPY",
  callbackUrl: "https://merchant.example.com/callbacks/kyc",
  timestamp: Math.floor(Date.now() / 1000),
  nonce: crypto.randomBytes(8).toString("hex"),
};
const canonical = "{" + Object.keys(body).filter((key) => body[key] != null).sort().map((key) => jsonString(key) + ":" + jsonString(String(body[key]))).join(",") + "}";
const signature = crypto.createHmac("sha256", SECRET_KEY).update(canonical).digest("hex");
const res = await fetch(BASE_URL + "/kyc-register", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "x-api-key": API_KEY,
    "x-signature": signature,
  },
  body: canonical,
});
console.log(res.status, await res.text());

kyc_register.py


import hashlib
import hmac
import json
import secrets
import time
import urllib.error
import urllib.request
 
API_KEY = "YOUR_API_KEY"
SECRET_KEY = "YOUR_SECRET_KEY"
BASE_URL = "https://api-sandbox.inspay.dev/merchant"
 
body = {
    "gateway": "YOUR_KYC_CHANNEL",
    "playerId": "player_abc123",
    "userName": "ヤマダ タロウ",
    "currency": "JPY",
    "callbackUrl": "https://merchant.example.com/callbacks/kyc",
    "timestamp": int(time.time()),
    "nonce": secrets.token_hex(8),
}
payload = {k: str(v) for k, v in body.items() if v is not None}
canonical = json.dumps(payload, sort_keys=True, separators=(",", ":"))
signature = hmac.new(SECRET_KEY.encode(), canonical.encode(), hashlib.sha256).hexdigest()
request = urllib.request.Request(
    BASE_URL + "/kyc-register",
    data=canonical.encode(),
    method="POST",
    headers={
        "Content-Type": "application/json",
        "x-api-key": API_KEY,
        "x-signature": signature,
    },
)
try:
    with urllib.request.urlopen(request) as response:
        print(response.status, response.read().decode())
except urllib.error.HTTPError as error:
    print(error.code, error.read().decode())

Response fields: playerId, gateway, status (PENDING), and message. message is informational text. The status starts at PENDING.

Status

POST /kyc/status

This path uses a slash. Body: gateway (same rules as registration), playerId, timestamp, nonce.

kyc-status.sh


API_KEY="YOUR_API_KEY"
SECRET_KEY="YOUR_SECRET_KEY"
BASE_URL="https://api-sandbox.inspay.dev/merchant"
 
CANONICAL='{"gateway":"YOUR_KYC_CHANNEL","nonce":"d4e5f6a7","playerId":"player_abc123","timestamp":"1791729147"}'
SIG=$(printf '%s' "$CANONICAL" | openssl dgst -sha256 -hmac "$SECRET_KEY" -hex | awk '{print $NF}')
 
curl -sS -X POST "$BASE_URL/kyc/status" \
  -H "Content-Type: application/json" \
  -H "x-api-key: $API_KEY" \
  -H "x-signature: $SIG" \
  --data-binary "$CANONICAL"

kyc-status.mjs


import crypto from "node:crypto";
 
const API_KEY = "YOUR_API_KEY";
const SECRET_KEY = "YOUR_SECRET_KEY";
const BASE_URL = "https://api-sandbox.inspay.dev/merchant";
 
function jsonString(value) {
  let out = '"';
  for (const ch of String(value)) {
    const cp = ch.codePointAt(0);
    if (ch === '"') out += '\\"';
    else if (ch === "\\") out += "\\\\";
    else if (ch === "\b") out += "\\b";
    else if (ch === "\f") out += "\\f";
    else if (ch === "\n") out += "\\n";
    else if (ch === "\r") out += "\\r";
    else if (ch === "\t") out += "\\t";
    else if (cp < 0x20 || cp > 0x7e) {
      if (cp > 0xffff) {
        const adj = cp - 0x10000;
        const hi = 0xd800 + (adj >> 10);
        const lo = 0xdc00 + (adj & 0x3ff);
        out += "\\u" + hi.toString(16).padStart(4, "0");
        out += "\\u" + lo.toString(16).padStart(4, "0");
      } else {
        out += "\\u" + cp.toString(16).padStart(4, "0");
      }
    } else out += ch;
  }
  return out + '"';
}
 
const body = {
  gateway: "YOUR_KYC_CHANNEL",
  playerId: "player_abc123",
  timestamp: Math.floor(Date.now() / 1000),
  nonce: crypto.randomBytes(8).toString("hex"),
};
const canonical = "{" + Object.keys(body).sort().map((key) => jsonString(key) + ":" + jsonString(String(body[key]))).join(",") + "}";
const signature = crypto.createHmac("sha256", SECRET_KEY).update(canonical).digest("hex");
const res = await fetch(BASE_URL + "/kyc/status", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "x-api-key": API_KEY,
    "x-signature": signature,
  },
  body: canonical,
});
console.log(res.status, await res.text());

kyc_status.py


import hashlib
import hmac
import json
import secrets
import time
import urllib.error
import urllib.request
 
API_KEY = "YOUR_API_KEY"
SECRET_KEY = "YOUR_SECRET_KEY"
BASE_URL = "https://api-sandbox.inspay.dev/merchant"
 
body = {
    "gateway": "YOUR_KYC_CHANNEL",
    "playerId": "player_abc123",
    "timestamp": int(time.time()),
    "nonce": secrets.token_hex(8),
}
payload = {k: str(v) for k, v in body.items() if v is not None}
canonical = json.dumps(payload, sort_keys=True, separators=(",", ":"))
signature = hmac.new(SECRET_KEY.encode(), canonical.encode(), hashlib.sha256).hexdigest()
request = urllib.request.Request(
    BASE_URL + "/kyc/status",
    data=canonical.encode(),
    method="POST",
    headers={
        "Content-Type": "application/json",
        "x-api-key": API_KEY,
        "x-signature": signature,
    },
)
try:
    with urllib.request.urlopen(request) as response:
        print(response.status, response.read().decode())
except urllib.error.HTTPError as error:
    print(error.code, error.read().decode())

Response fields: playerId, gateway, status, providerStatus, updatedAt.

Coming soonproviderStatus becomes an InsPay-defined value. Do not branch on today’s providerStatus text.

Never registered:

kyc-missing.json


{"message": "No KYC registration found for this player."}

HTTP status 404.

KYC statuses

Status	What to do
`PENDING`	Still processing. Registration can take up to 30 minutes.
`REGISTERED`	Deposits are accepted for this player.
`FAILED`	Check the name and register again.
`EXPIRED`	Register again.

The final status is also posted to the registration callbackUrl. See callbacks.