Docs · Connect your tools
Connect Youverify
StackWeaver reads, and never changes, one read-only endpoint on your Youverify account once a day, through a secret key you create yourself. Today this confirms the key is valid and reachable; it does not yet perform or evidence a real identity verification. This guide says exactly what is read, which permission the key needs, how to create one, and how to remove it.
Last reviewed: 6 November 2026 · Describes what is live in production on that date. A result is evidence of what the provider returned at a time, nothing more.
1. What it collects
Once a day StackWeaver calls Youverify's API with the secret key you paste. The result is kept as an Evidence Object with a SHA-256 fingerprint (platform), including a result that fails.
| Check (as shown in the portal) | What it looks at |
|---|---|
| API key valid and reachable | Whether the stored key is accepted and Youverify's verification-types catalog responds. Evidence only: no threshold is applied. |
2. What it does not do
- It does not perform or evidence a real identity verification. No document, BVN, NIN or other personal lookup is run through this connector. The one check reads a static catalog of document types, never a real person's data.
- It cannot change anything: the key is used for one read-only endpoint.
- It does not say your KYC or AML programme meets any requirement. A result is what Youverify returned at a certain time.
- It works against either a sandbox or a production Youverify key; you say which when you connect.
3. The access it needs
One credential: a secret key, sent as the `token` header on every request (Youverify). Youverify issues separate keys for its sandbox and production environments.
Who can connect. In StackWeaver, a workspace owner or admin pastes the key. Youverify does not tell StackWeaver who created the key or what role they hold, so create it with no more access than this one read-only check needs.
4. Connect steps
- In Youverify's dashboard, open API/Webhooks and create (or copy) a secret API key.
- In StackWeaver, open Evidence, the Youverify section, and paste the key. Type "sandbox" in the environment field for a sandbox key, or leave it empty for a production key.
- Press Test connection. StackWeaver records the result and fills in the account fingerprint automatically.
5. Reading the results
| Label | What it means |
|---|---|
| Pass | The provider returned data that meets the threshold at that time |
| Fail | The provider returned data that does not meet the threshold |
| Not enabled | There was nothing to check, or the feature needs a plan StackWeaver could not confirm |
| Could not check | StackWeaver could not read the data, or the check needs a higher plan than the account has |
6. Disconnect and revoke
- In StackWeaver, press Disconnect on the Youverify section. StackWeaver deletes the stored key.
- In Youverify's dashboard, revoke or delete the key yourself — StackWeaver has no way to ask Youverify to revoke a key on your behalf.
What remains. Past evidence stays in your workspace as the audit trail. Disconnecting does not delete it.
7. Troubleshooting
| Message | What to do |
|---|---|
| Youverify refused the key: it may be wrong or revoked | Check the key was copied in full, and that the environment field matches the key (sandbox keys only work against a sandbox connection; production keys only against a production one) |
| This key belongs to a different Youverify account than the one already connected here | Disconnect first if you mean to switch to a different Youverify account |
Still stuck? Use the contact page.
Sources and method
Statements about GitHub and Okta link to their own documentation. Statements about StackWeaver link to the page that says them, or are recorded in a claims ledger with the file in StackWeaver's repository that they come from. See oureditorial policy. Spotted an error? Use the contact page.