This guide covers the Customer API side of issuing a card to a user your program invited on the Management API. Every call here uses the user’s bearer token.
The application already exists. The invite creates the user and their application. So unlike self-serve onboarding, you do not call POST /v1/applications here — the user signs in to an application that’s already waiting for them.

​
The flow

​
Step 1 — Sign in

The user signs in with the email and the temporary password from their invite email. Login returns NEW_PASSWORD_REQUIRED, so they change the temporary password and then set up 2FA or a passkey. See Authentication. Use the resulting token on every call below. When the application’s currentStep is LEGAL_AGREEMENTS, accept the program’s terms:
Acceptance is idempotent. See Accept legal agreements.

​
Step 3 — Complete KYC

Fetch the KYC form schema, render it, and submit the answers:
The exact fields and number of steps depend on the program’s configured schema. See Get the KYC schema and Submit KYC data.

​
Step 4 — Identity verification (Sumsub)

Get a Sumsub web token and pass it to the Sumsub Web/Mobile SDK for document upload and liveness:
See Get a Sumsub token.

​
Step 5 — Wait for approval

Poll GET /v1/applications and render the screen for each currentStep. When currentStep is null, onboarding is done. (Your program also gets a webhook on approval.) The full status model is in the Onboarding overview.

​
Step 6 — Read customerId and accountId

The approved application carries the customerId, and the user’s primary account is created automatically. Read it to get the accountId:
See List accounts.

​
Step 7 — Order the card

See Create a card.

​
Funding

How the card is funded depends on how the program invited the user:
  • Managed (a prepaid-card invite) — the program loads funds from its master account; nothing for your app to do.
  • Default (a plain invite) — the user’s account has an assigned IBAN; the user funds the card by transferring to it.
The program-side detail (the invite + Load/Unload) is on the Management docs.