# sumsub-api-auth

This skill signs Sumsub API requests with HMAC-SHA256 and helps diagnose 401 errors. Use it for integration work or one-off request checks.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1200 installs · ★ 7
- Author: sumsub
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/sumsub/agent-skills/tree/HEAD/skills/sumsub-api-auth/SKILL.md
- Updated: 2026-10-02
- HTML: https://affpapa.org/en/nevibecode/skills/sumsub-api-auth

## What it does

The skill covers Sumsub API authentication with an App Token and secret key. It builds `X-App-Token`, `X-App-Access-Ts`, and `X-App-Access-Sig`, using the HTTP method, request path with its query string, and the exact request body for the HMAC-SHA256 signature.

It includes `scripts/sumsub_sign.py`, which prints authentication headers without making a network call, and `scripts/sumsub_curl.sh`, which signs and sends a request with `curl`. The guidance also checks common causes of `401`, such as an incorrect timestamp, method, path, or body bytes. A sandbox App Token and secret key are required; production credentials must not be used with Claude.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add sumsub/agent-skills --skill sumsub-api-auth -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/sumsub-api-auth/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/sumsub-api-auth/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add sumsub/agent-skills --skill sumsub-api-auth -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/sumsub-api-auth/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add sumsub/agent-skills --skill sumsub-api-auth -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/sumsub-api-auth/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install sumsub/agent-skills sumsub-api-auth
```

2. **Manually: put the files in place**
- File: `.github/skills/sumsub-api-auth/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add sumsub/agent-skills --skill sumsub-api-auth -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/sumsub/agent-skills --path skills/sumsub-api-auth
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/sumsub-api-auth/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add sumsub/agent-skills --skill sumsub-api-auth -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/sumsub/agent-skills/tree/HEAD/skills/sumsub-api-auth/SKILL.md

## When to use it
- sign a request to the Sumsub API
- debug a `401 Unauthorized` response
- check authentication headers with `curl`
- create a signature for JSON or multipart data

## Example prompts
- Sign a GET request to `/resources/applicants/-/count` and show the required headers.
- Find the cause of the `401 Invalid signature` response from `api.sumsub.com`.
- Create a signing example for a `POST` request with query parameters and a JSON body.

## Similar
- [api-auth-key-management](https://affpapa.org/en/nevibecode/skills/api-auth-key-management.md) — skill · 7800 installs
- [api-auth-and-jwt-abuse](https://affpapa.org/en/nevibecode/skills/api-auth-and-jwt-abuse.md) — skill · 3800 installs
- [twilio-security-api-auth](https://affpapa.org/en/nevibecode/skills/twilio-security-api-auth.md) — skill · ★ 7604
- [better-auth-best-practices](https://affpapa.org/en/nevibecode/skills/better-auth-best-practices.md) — skill · 126700 installs
- [better-auth-security-best-practices](https://affpapa.org/en/nevibecode/skills/better-auth-security-best-practices.md) — skill · 48000 installs
- [convex-auth](https://affpapa.org/en/nevibecode/skills/convex-auth.md) — skill · 36500 installs

From the same set: [sumsub/agent-skills](https://affpapa.org/en/nevibecode/by/sumsub/agent-skills.md) — 25 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md