Korean Identity SDK

.NET — Axowl.Sdk.Korean.Identity.Client

The package answers one question on your server: has this signed-in user completed Korean real-name verification? The verification itself runs in the browser (see Server side).

dotnet add package Axowl.Sdk.Identity.Client          # token validation
dotnet add package Axowl.Sdk.Korean.Identity.Client

builder.Services.AddAxowlIdentity(opts => { /* see Identity SDK */ });
builder.Services.AddAxowlKoreanIdentity(opts =>
{
    opts.ApiKey    = builder.Configuration["Axowl:ApiKey"]!;   // org API key (ah_live_...)
    opts.Transport = TransportMode.GrpcWithFallback;
});

AddAxowlKoreanIdentity does not validate tokens itself — register AddAxowlIdentity first. Options: ApiKey (required), Transport (Grpc by default, GrpcWithFallback, RestOnly), ServerAddress (https://grpc.axowl.com), RestServerAddress (https://api.axowl.com), CallTimeout (10 seconds).

[RequireKoreanIdentity]

// Minimal API
app.MapPost("/shop/checkout", [RequireKoreanIdentity(Purpose = "shop-checkout")] () => Results.Ok());
app.MapPost("/age-gate", () => Results.Ok()).RequireKoreanIdentity("age-gate");

// MVC
[HttpPost("/checkout"), RequireKoreanIdentity]                       // any purpose
[HttpPost("/age-gate"), RequireKoreanIdentity(Purpose = "age-gate")] // one specific purpose

Use 0.1.3 or later

Versions before 0.1.3 enforce the attribute on MVC controllers only. On a minimal-API handler they let the request through without checking.

• Works on minimal-API endpoints and on MVC controllers and actions. The app must call app.UseAuthorization().
• No authenticated user answers 401. A user who has not verified answers 403 with the header Axowl-Korean-Identity-Required: <purpose or "any"> — read the header; the response has no body.
• The check asks Axowl on every request and fails closed: a failed call is a 403.

IAxowlKoreanIdentityClient

var status  = await korean.GetStatusAsync(token, purpose: "age-gate", ct);   // status.Verified, .Method, .VerifiedAt
var history = await korean.ListAsync(token, ct);                             // every verification record

token is the end user’s access token. GetStatusAsync returns the latest active verification for the purpose (purpose: null = any purpose); Verified is false when there is none. The REST forms are POST /v1/korean-identity/status and POST /v1/korean-identity/list.

Server side

Verification is driven through PortOne — …/apps/{applicationKey}/identity/korean/initiate and …/finalize. In the browser, @axowl/sdk-core runs the whole flow (initiate, the PortOne window, finalize) in one call: await client.korean.verifyIdentity({ purpose: 'age-gate' }). A PortOne webhook is a safety net (see Webhooks).