Advanced embed configuration

By default, the first time a user opens the hosted embed through your app, OroPocket sends them an OTP, and buying beyond the basics needs our KYC. If your app has already verified the mobile number and done KYC (for example through DigiLocker or an Aadhaar OKYC provider), you can skip both.

1. Skip the OTP

With Skip OTP on embed login on, the embed_url you get from /partner/users/init opens straight into the user's account. There is no OTP screen, and nothing changes in your call.

• New users get an OroPocket account created on that first open, linked to you.
• People who already use OroPocket are logged in too. Inside your embed they see only what they hold through you (their sub-wallet), never what they hold elsewhere.
• Use a fresh link every time. Each embed_url works once and for 10 minutes. If you build the URL yourself from a user's permanent user_code, the user is still asked for an OTP: a permanent code can leak through browser history or logs, so it is never treated as a login.
• Suspended accounts are refused exactly as before.
• Sandbox. With an oro_test_ key the OTP is skipped too, so you can test the flow end to end.

2. Send the user's KYC

With Accept partner KYC at user init on, add a kyc object to the same call. We check it on our side (no second verification for the user) and, if it passes, their OroPocket KYC is approved before they open the embed. Their name, date of birth and email are taken from it, so they also skip the profile screen.

Keys we read from aadhaar_data (the usual OKYC and DigiLocker spellings both work):

curl -X POST https://api.oropocket.com/partner/users/init \
  -H "Authorization: Bearer oro_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "flow": "embed",
    "mobile": "9876543210",
    "name": "Asha Kumari",
    "email": "asha@example.com",
    "kyc": {
      "pan": "ABCPK1234Z",
      "aadhaar": "XXXXXXXX4321",
      "dob": "1990-08-15",
      "email": "asha@example.com",
      "aadhaar_data": {
        "name": "Asha Kumari",
        "dob": "15-08-1990",
        "gender": "F",
        "care_of": "D/O Ram Kumar",
        "masked_aadhaar": "xxxxxxxx4321",
        "reference_id": "your-okyc-reference",
        "address": {
          "house": "12", "street": "MG Road", "landmark": "Near the park",
          "vtc": "Pune", "district": "Pune", "state": "Maharashtra", "pincode": "411001"
        }
      }
    }
  }'

3. The kyc result

A KYC problem never stops the login. You always get the embed_url, plus a kyc block telling you what happened. If KYC was not approved, the user can complete it in the embed later, the normal way.

{
  "success": true,
  "request_id": "req_xxx",
  "mode": "live",
  "data": {
    "user_code": "usr_xxx",
    "embed_url": "https://connect.oropocket.com/?u=usr_yyy",
    "expires_at": "2026-10-13T09:22:00.000Z",
    "expires_in_seconds": 600,
    "user_existed": false,
    "mode": "live",
    "kyc": { "status": "approved", "errors": [], "persisted": true }
  }
}

"kyc": {
  "status": "rejected",
  "persisted": false,
  "errors": [
    { "code": "DOB_MISMATCH", "field": "kyc.dob", "message": "dob does not match aadhaar_data." }
  ]
}

Error messages never repeat the values you sent. You can check a user's KYC at any time with GET /partner/users/:user_code/kyc/status (see KYC).

4. Request errors

These refuse the whole request, like any other contract error. No link is issued.

5. How we handle the data

• The KYC is recorded as attested by you, separately from KYC we verified ourselves, with your account against it.
• We keep the PAN, the Aadhaar number (only the last 4 digits when you send it masked), the name, date of birth, gender, address and email. Photos, XML, signatures and share codes are dropped and never stored.
• Request bodies are never written to your request logs, and our own logs carry masked values only.
• Send only KYC you have actually verified, with the user's consent to share it with OroPocket.

Related: Open the embed on a screen (use launch in the same call) and WebView & UPI setup.