# Configure a workspace A configuration always starts by choosing one of the four workspaces. The workspace decides which rules you can set. You then build it in the **Configure** tab. ![New Proof of Human configuration](/docs/docs-assets/new-proof-of-human.avif) ## Pick a workspace | Workspace | What the user proves | Rules you can set | | --- | --- | --- | | **[Pre-KYC](/docs/self-enterprise/workspaces/pre-kyc/)** | Holds a genuine document, optionally meets an age floor, comes from an allowed country, clears OFAC | Security level, OFAC, minimum age, country rules, plus Additional data reveals | | **[Age Verification](/docs/self-enterprise/workspaces/age-verification/)** | Meets an age threshold | Security level, OFAC, minimum age | | **[Proof of Human](/docs/self-enterprise/workspaces/proof-of-human/)** | Is a unique, real human | Security level, OFAC | | **[Sovereign](/docs/self-enterprise/workspaces/sovereign/)** | Holds a genuine document from a nationality you allow | Security level, nationality allowlist | Every workspace has a **Security level**. Sovereign gates on a **nationality allowlist** and runs no OFAC or age rules. All of these are covered below; for what each workspace is for, see the [workspaces overview](/docs/self-enterprise/workspaces/). ## The Configure tab The Configure tab has its cards on the left. On the right, a live **proof-request preview** shows what the user will see, and a **credit usage** callout shows what each verification will cost. Once the configuration is deployed, a **Try this flow** callout also appears. ### Organization details This card is read-only. It shows your **Organization name** and **Organization icon** (the icon shown on the proof request and the hosted verification page) with a **Manage organization** link into **Settings → General**. The **configuration name** is set inline in the page title at the top of the Configure tab, not in this card. ### Verification mode Every workspace offers two [verification modes](/docs/self-enterprise/flows/verification-modes/): * **Backend** (the default): proofs are verified by Self's servers; results arrive through webhooks and the API. * **On-chain**: proofs are verified on Celo, and each verified user receives a soulbound token (SBT). Deploying also [deploys the flow's contracts](/docs/self-enterprise/flows/onchain-verification/) to both Celo networks. Like every other setting, the mode is frozen at deploy. Keep **Backend** unless other smart contracts need to read your verification results. ### Disclosure rules The predicates the user must satisfy. The user proves each one without revealing the underlying value. * **Security level** (all workspaces): **Standard** verifies the document is genuine; **Hi-security** (the default) also verifies the user physically scanned the document's chip. * **OFAC check** (Pre-KYC, Age Verification, Proof of Human, on by default): match against the US Treasury OFAC sanctions list. Self keeps the list updated daily, and only the pass or fail result is disclosed. Sovereign has no OFAC check. * **Minimum age** (Pre-KYC, Age Verification): the age threshold (13–110, default 18 for Pre-KYC and 21 for Age Verification). Only the pass or fail result is disclosed, never the date of birth. * **Excluded countries** (Pre-KYC): documents issued by a country on this list fail. Only the pass or fail result is disclosed, not the user's country. ISO 3166-1 alpha-3 codes. * **Included countries** (Pre-KYC optional, Sovereign required): an allowlist: only holders from a country on this list pass. In Pre-KYC it's mutually exclusive with the excluded list (setting one clears and disables the other) and optional; in Sovereign it's the workspace's core rule and can't be empty, so a Sovereign flow always gates on nationality. Either way the list is enforced against the holder's **disclosed nationality**, so it **forces the Nationality reveal on** and discloses the user's nationality to you. The country picker offers **region presets** (EU, APAC, LATAM, GCC) that add or remove a whole bloc at once, so you don't have to enumerate countries one by one. ISO 3166-1 alpha-3 codes. On-chain configurations cap the lists at **40 excluded** or **41 included** countries; the picker enforces this as you select. ### Additional data (Pre-KYC) For **Pre-KYC**, beyond the pass or fail rules, you can ask the user to disclose specific document fields. Each is an explicit reveal, **off by default**, request only what you need: `Full name`, `ID number`, `Date of birth`, `Gender`, `Nationality`, `Expiration date`, `Issuing state`. When an **Included countries** rule is set, the **Nationality** toggle is forced on and locked, because the allowlist is checked against the disclosed nationality. ![Deployed Pre-KYC configuration](/docs/docs-assets/published-kyc-product.avif) ## Deploy Click **Deploy** to take the configuration live; the dashboard validates it first. Once deployed, the **Test** and **Live** tabs show its `flowId` and SDK snippets, and you generate [API keys](/docs/self-enterprise/dashboard/api-keys/) under **Developer → API keys**. Use **Reset parameters** to clear your edits before deploying. For an **on-chain** configuration, the status pill tracks the contract deploys (**Deploying → Deployed**), and a failed deploy can be retried from its environment tab (your configuration is saved either way). See [Deploy status](/docs/self-enterprise/flows/onchain-verification/#deploy-status). A workspace keeps one active configuration at a time. Once deployed, a configuration is immutable, you can't edit it. To change anything, archive it and create a new one. In-flight sessions keep using the version they were created against, so archiving never breaks an open session. ## Related * [Disclosures](/docs/self-enterprise/flows/disclosures/): what each rule and reveal proves. * [Supported documents](/docs/self-enterprise/flows/supported-documents/): which documents work where. * [API keys](/docs/self-enterprise/dashboard/api-keys/): generate the keys your backend uses.