Configure a workspace
A configuration always starts by choosing one of the four workspaces. The workspace decides which rules you can set. You then build it in the Configure tab.
Pick a workspace
| Workspace | What the user proves | Rules you can set |
|---|---|---|
| Pre-KYC | Holds a genuine document, optionally meets an age floor, comes from an allowed country, clears OFAC | Security level, OFAC, minimum age, country rules, plus Additional data reveals |
| Age Verification | Meets an age threshold | Security level, OFAC, minimum age |
| Proof of Human | Is a unique, real human | Security level, OFAC |
| Sovereign | Holds a genuine document from a nationality you allow | Security level, nationality allowlist |
Every workspace has a Security level. Sovereign gates on a nationality allowlist and runs no OFAC or age rules. All of these are covered below; for what each workspace is for, see the workspaces overview.
The Configure tab
The Configure tab has its cards on the left. On the right, a live proof-request preview shows what the user will see, and a credit usage callout shows what each verification will cost. Once the configuration is deployed, a Try this flow callout also appears.
Organization details
This card is read-only. It shows your Organization name and Organization icon (the icon shown on the proof request and the hosted verification page) with a Manage organization link into Settings → General. The configuration name is set inline in the page title at the top of the Configure tab, not in this card.
Verification mode
Every workspace offers two verification modes:
- Backend (the default): proofs are verified by Self’s servers; results arrive through webhooks and the API.
- On-chain: proofs are verified on Celo, and each verified user receives a soulbound token (SBT). Deploying also deploys the flow’s contracts to both Celo networks.
Like every other setting, the mode is frozen at deploy. Keep Backend unless other smart contracts need to read your verification results.
Disclosure rules
The predicates the user must satisfy. The user proves each one without revealing the underlying value.
- Security level (all workspaces): Standard verifies the document is genuine; Hi-security (the default) also verifies the user physically scanned the document’s chip.
- OFAC check (Pre-KYC, Age Verification, Proof of Human, on by default): match against the US Treasury OFAC sanctions list. Self keeps the list updated daily, and only the pass or fail result is disclosed. Sovereign has no OFAC check.
- Minimum age (Pre-KYC, Age Verification): the age threshold (13–110, default 18 for Pre-KYC and 21 for Age Verification). Only the pass or fail result is disclosed, never the date of birth.
- Excluded countries (Pre-KYC): documents issued by a country on this list fail. Only the pass or fail result is disclosed, not the user’s country. ISO 3166-1 alpha-3 codes.
- Included countries (Pre-KYC optional, Sovereign required): an allowlist: only holders from a country on this list pass. In Pre-KYC it’s mutually exclusive with the excluded list (setting one clears and disables the other) and optional; in Sovereign it’s the workspace’s core rule and can’t be empty, so a Sovereign flow always gates on nationality. Either way the list is enforced against the holder’s disclosed nationality, so it forces the Nationality reveal on and discloses the user’s nationality to you. The country picker offers region presets (EU, APAC, LATAM, GCC) that add or remove a whole bloc at once, so you don’t have to enumerate countries one by one. ISO 3166-1 alpha-3 codes. On-chain configurations cap the lists at 40 excluded or 41 included countries; the picker enforces this as you select.
Additional data (Pre-KYC)
For Pre-KYC, beyond the pass or fail rules, you can ask the user to disclose specific document fields. Each is an explicit reveal, off by default, request only what you need:
Full name, ID number, Date of birth, Gender, Nationality, Expiration date, Issuing state.
When an Included countries rule is set, the Nationality toggle is forced on and locked, because the allowlist is checked against the disclosed nationality.
Deploy
Click Deploy to take the configuration live; the dashboard validates it first. Once deployed, the Test and Live tabs show its flowId and SDK snippets, and you generate API keys under Developer → API keys. Use Reset parameters to clear your edits before deploying.
For an on-chain configuration, the status pill tracks the contract deploys (Deploying → Deployed), and a failed deploy can be retried from its environment tab (your configuration is saved either way). See Deploy status.
A workspace keeps one active configuration at a time. Once deployed, a configuration is immutable, you can’t edit it. To change anything, archive it and create a new one. In-flight sessions keep using the version they were created against, so archiving never breaks an open session.
Related
- Disclosures: what each rule and reveal proves.
- Supported documents: which documents work where.
- API keys: generate the keys your backend uses.
Thanks for your feedback!
