The layer between knowing what to build and having the keys. Which components are self-serve, which need a sandbox and a sales conversation, which are licensed, and the order to do it in so the licence does not become your end date.
Every build sheet on this site tells you what to buy. Every product guide tells you what it costs. This page tells you how to actually get the keys — which components you can sign up for this afternoon, which need a sales conversation, and which are gated behind a licence you may not want.
It exists because the gap between those two things is where most Indian fintech builds stall, and because it is the question nobody answers in public.
This is the developer access layer. For the regulatory layer — which licence you need to operate at all, what each costs, and how long it takes — see Licensing and Access. The two are different questions and people conflate them constantly: you can hold an API key and not be permitted to use it commercially, and you can hold a licence and still have no integration.
Three tiers, and knowing which tier a component sits in saves weeks:
| Tier | What it means | How long |
|---|---|---|
| 1 — Self-serve | Create an account, get keys, start calling | An afternoon |
| 2 — Vendor sandbox | Free sandbox, production behind a sales conversation | Days to weeks |
| 3 — Licensed | You must be, or go through, an authorised entity | Months, or never |
The single most useful thing on this page: almost nobody builds tier 3 themselves. You do not become an AUA to read an Aadhaar. You integrate with an aggregator who already is one — the licence sits with them, you call REST over HTTPS. That is what Setu, Surepass, Signzy and Sandbox are, and it is the difference between a nine-month permission project and a fortnight of engineering. The licence is a thing to rent before it is a thing to own.
| What you need | Tier | Route |
|---|---|---|
| DigiLocker documents | 1 | Government sandbox, or an aggregator |
| PAN verification | 1 | Aggregator, free trial |
| Bank account verification | 1 | Aggregator, free trial |
| GST and business data | 1 | Aggregator or a GSP |
| Aadhaar (offline XML, DigiLocker) | 1–2 | Aggregator |
| Liveness and face match | 2 | Vendor sandbox, then sales |
| Aadhaar e-KYC (online authentication) | 3 | AUA/KUA, or through one |
| Account Aggregator data | 3 | FIU registration, or a TSP |
| UPI / NPCI rails | 3 | Sponsor bank. Always |
| CTS cheque clearing | 3 | Clearing membership |
These are real, free or trial-based, and require no licence and no sales call.
| Route | What it gives you |
|---|---|
| API Setu sandbox.api-setu.in | The government's own open API platform, from MeitY. Includes a DigiLocker sandbox. Free. Start here if you want to understand the data before choosing a vendor |
| Sandbox developer.sandbox.co.in/docs | Sign up → get an API key and secret from the console → exchange them for a 24-hour access token → call. Separate test and production credentials, which is the part that matters. Covers PAN, bank account, Aadhaar, GST, MCA, DigiLocker and EntityLocker, and holds an ERI licence for income-tax APIs, which is unusual. Verified against their live quickstart, September 2026 |
| Setu setu.co/data/kyc | 40+ data APIs behind one integration, working through NSDL, UIDAI and DigiLocker. Sandbox on request, keys issued per organisation |
Start with API Setu even if you will buy from a vendor. It is free, it is the source, and an afternoon on it tells you what the data actually looks like — which fields exist, which are blank in practice, what the consent flow feels like. Every vendor demo is built on a clean record. Yours will not be.
The verification and liveness specialists. All of these publish a sandbox; almost none publishes a price.
| Vendor | Sandbox | Pricing |
|---|---|---|
| Surepass | Free sandbox | Contact sales |
| Signzy | Sandbox environments | Quote only |
| HyperVerge | On request | Quote only, no published free tier |
| IDfy | On request | Quote only |
| Digio | On request | Quote only |
| iProov | On request | Quote only — liveness specialist |
Almost every Indian KYC vendor is quote-only, and that is worth knowing before you are quoted. There is no public rate card to compare against, so the first number you hear anchors everything. Get three quotes on the same volume assumption and the same component list, because the bundling differs more than the unit price does — and ask specifically whether injection detection is included or an add-on. The ones that meter it separately are frequently the ones that actually have it.
These cannot be bought and there is no workaround, because the gate is a licence rather than a price.
The aggregator route is not a loophole and it is not second best. A regulated entity using a licensed aggregator is the normal architecture, not a shortcut around one — the aggregator holds the authorisation, carries the UIDAI obligations, and passes you a REST interface. What you must still do is your own: consent, purpose limitation, the Aadhaar Data Vault if you store the number, and answering for the outcome. The licence is theirs. The obligation is yours.
Most builds get this backwards and lose a month.
Do not test with real Aadhaar numbers, including your own. A sandbox is not a compliance-free zone, and a colleague's identity document in a test database is the same personal data it would be anywhere else — and it will still be there two years later. Use the provider's test identities. If a provider has no test identities, that is a finding about the provider.
The number to establish before any sales call: your monthly verification volume, and the share that will fail and be retried. Every quote is a function of those two, and walking in without them means being priced on the vendor's assumption rather than yours.
Do: sign up at API Setu → pull a DigiLocker document in the sandbox → sign up for one aggregator trial → verify a PAN and a bank account.
You get: a working understanding of the data, the consent flow and the failure modes, for nothing. Almost nobody does this before choosing a vendor, and it is the step that makes the vendor conversation useful.
Do: the above, plus build the full onboarding flow against the sandbox with your own edge cases → three quotes on identical assumptions → test-identity coverage confirmed → the Aadhaar Data Vault designed if you will store the number.
Trade: two weeks against a decision you will live with for years.
Do: the above, plus start the licence or sponsor-bank conversation on day one, in parallel, because it is the only item on the critical path measured in months.
It breaks when: the licence is treated as a later phase. Everything else here can be compressed and that cannot, so a plan that sequences it last has already decided its own end date.
If you take one thing from this page: you almost certainly do not need to hold the licence yourself. Rent it from an aggregator, build in a fortnight, and revisit ownership when the volume makes it worth the nine months. The obligations stay yours either way.
| What goes wrong | Why | Fix |
|---|---|---|
| Licence started last | Treated as paperwork, not a dependency. | It is the only item measured in months. Day one, in parallel. |
| Free trial burned during planning | Activated before anyone was ready to build. | Start the clock when a developer is. |
| Vendor chosen before touching the data | Demos are built on clean records. | Sandbox first. Your data is not clean. |
| Quotes not comparable | Different bundles, different volumes. | Identical component list, identical volume, three vendors. |
| Injection detection assumed included | It was listed under liveness. | Ask explicitly. Separately metered often means genuinely present. |
| Real Aadhaar numbers in the sandbox | Testing with what was to hand. | Provider test identities. It is still personal data. |
| Sandbox lapsed after go-live | Seen as a pre-launch tool. | Keep it. It is where you reproduce incidents safely. |
| Aggregator treated as the compliance owner | They hold the licence. | The licence is theirs. The obligation is yours. |
The regulatory layer — which licence, what it costs, how long.
Every tool named, with what each one costs per unit.
The product these components assemble into.
What you must do with the number once you have it.
This page names third-party providers and describes their access terms as read in September 2026. It is not an endorsement, nothing here is a recommendation of one vendor over another, and commercial terms change without notice. Nothing here is legal advice. Confirm every access route, sandbox term and price directly with the provider, and confirm your licensing position with qualified counsel before processing real identity data.
Every figure, rule and date on this page, and where to check it. Entries are typed so you can see which are primary-sourced and which are vendor or industry material.
Checked September 2026. Vendor sandboxes, trial terms and pricing change without notice and are the least durable material on this site. Confirm before relying on any of it.
Opens your assistant with this page as the source, and a question rather than a summary. It will ask what you are building before it answers.
Nothing is sent from here. The link carries only this page’s title and address.