Server SDKs: Node, Go, Python and more

Your backend talks to Toden with a secret key: to create sessions, read verification results, and make every Risk Intelligence call. This page says honestly what exists for each language today.

What is available

Client SDKs for capturing a verification (React, React Native, Flutter) are published. See Choose an SDK.

Call the API directly

The API is plain JSON over HTTPS, so every language works today. The examples below make the same Sandbox request: a transaction decision.

Set your key in the environment first. Never write it into source.

export TODEN_SECRET_KEY="sk_test_..."

// Node.js 20 or later. No dependencies.
const response = await fetch("https://sandbox-api.toden.co/api/v1/transactions", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.TODEN_SECRET_KEY}`,
    "Content-Type": "application/json",
    "Idempotency-Key": "order-1001-payment",
  },
  body: JSON.stringify({
    externalActivityId: "order-1001-payment",
    subject: { type: "individual", externalUserId: "user_42" },
    occurredAt: new Date().toISOString(),
    transaction: {
      externalTransactionId: "transfer-1001",
      assetClass: "fiat",
      direction: "outbound",
      amount: "12500.00",
      currency: "NGN",
      transactionType: "bank_transfer",
      parties: [
        { role: "sender", externalUserId: "user_42" },
        { role: "recipient", externalPartyId: "supplier-7", type: "business", displayName: "Sample Supplier" },
      ],
    },
  }),
});
const body = await response.json();
if (!response.ok) {
  // /api/v1 errors: { error: { type, code, message, request_id } }
  throw new Error(`${body.error.type} ${body.error.code} (${body.error.request_id})`);
}
console.log(body.assessment.summary.outcome);

What you should see: a 2xx response whose assessment.summary.outcome is allow, review or block. Sending the same request again with the same Idempotency-Key returns the original decision. The full walkthrough is the Risk Intelligence quickstart.

Rules every server integration must follow

• The secret key comes from the environment or a secrets manager. It never reaches a browser, a mobile app, a log line or a repository.
• /api/kyc and /api/v1 return different error bodies. Parse each one separately. See Errors.
• Make writes safe to retry. See Requests, retries and idempotency.
• A failed or timed-out risk decision is not an approval.
• Verify every webhook signature on the raw request bytes. See Verify signatures.

Generate a client from the contracts

Both API contracts are OpenAPI 3.1 documents, so you can generate a typed client in your own language today.

go install github.com/oapi-codegen/oapi-codegen/v2/cmd/oapi-codegen@latest
curl -sS https://api.toden.co/api/openapi.json -o toden-risk.json
oapi-codegen -generate types,client -package toden toden-risk.json > toden/client.gen.go

Next steps