SDK guide

SKOR currently provides a JavaScript SDK. More SDKs will be available soon. Use the SDK when you want an iframe-based integration where SKOR manages the tenant workflow and your application launches the profile session.

Installation

The JavaScript SDK is available by URL. Choose the URL that matches your credentials and environment.

Production
Sandbox

<script src="https://api.skortorent.com/sdk/skor.js"></script>

<script src="https://dev-api.skortorent.com/sdk/skor.js"></script>

To test in the sandbox, use https://dev-api.skortorent.com/sdk/skor.js together with sandbox credentials and the https://dev-api.skortorent.com/api/v1 API base URL. Do not mix sandbox tokens or credentials with the production SDK.

Initialize

After including the SDK, initialize it with your client_id.

const sdk = Skor({
  clientId: "YOUR_CLIENT_ID",
});

The SDK is initialized with your public client_id. Your client_secret is used only for server-side calls and must never be exposed in browser code. See the Authentication guide for how to generate a server access token.

API keys can be configured in persistent or non-persistent mode by an administrator when the key is created. Contact your SKOR administrator if this mode needs to be changed. A tenant first created through a non-persistent key can use the embedded onboarding session but cannot sign in to the SKOR tenant application or use its password-recovery flow. This setting does not remove login access from a pre-existing SKOR account.

Start a profile session

Starting a profile session is a two-part flow: use the APIs to create the application, associate the property, and generate an application participant’s onboarding token; then use the SDK to launch the profile session with that token.

1. Using the APIs — generate an onboarding token

Using your Bearer access token (see the Authentication guide):

Create the property with the Property Management API and keep its property_id.
Create an application with Create Application, passing the required title and the tenant emails and marking exactly one entry with is_lead: true. A guarantor cannot be the lead: mark guarantors with is_guarantor: true and is_lead: false (is_guarantor defaults to false when omitted). title is required. Keep the returned application_id. Application creation is email-only: every participant starts as pending, and invitations are sent to all non-lead emails, including guarantors, without looking up or creating tenant accounts.

Production
Sandbox

curl -X POST "https://api.skortorent.com/api/v1/applications/create-application" \
  -H "Authorization: Bearer $SKOR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"title":"Carrer de Mallorca 123 application","tenants":[{"email":"lead@example.com","is_lead":true},{"email":"cotenant@example.com","is_lead":false},{"email":"guarantor@example.com","is_lead":false,"is_guarantor":true}]}'

curl -X POST "https://dev-api.skortorent.com/api/v1/applications/create-application" \
  -H "Authorization: Bearer $SKOR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"title":"Carrer de Mallorca 123 application","tenants":[{"email":"lead@example.com","is_lead":true},{"email":"cotenant@example.com","is_lead":false},{"email":"guarantor@example.com","is_lead":false,"is_guarantor":true}]}'

Call Generate Tenant Onboarding Token with the email of the participant starting onboarding. This resolves or initializes the tenant and stores the resolved tenant ID on the participant. The participant’s consent remains pending until onboarding is completed; only then does SKOR change their consent_status to accepted. In the standard flow, generate a token separately for each participant when they begin onboarding.

The iframe uses the application identified by the onboarding token. Tenants do not see SKOR’s application-creation step or application navigation during this embedded flow.

Production
Sandbox

curl -X POST "https://api.skortorent.com/api/v1/tenants/onboarding-token" \
  -H "Authorization: Bearer $SKOR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"tenant_email":"TENANT_EMAIL","application_id":"APPLICATION_ID","property_id":"PROPERTY_ID"}'

curl -X POST "https://dev-api.skortorent.com/api/v1/tenants/onboarding-token" \
  -H "Authorization: Bearer $SKOR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"tenant_email":"TENANT_EMAIL","application_id":"APPLICATION_ID","property_id":"PROPERTY_ID"}'

The response returns the resolved tenant_id, is_profile_outdated, requires_login_with_skor, and a nullable token. New tenants and existing incomplete tenants already linked to your API key receive an onboarding token directly. If an existing account is not yet linked to your key, SKOR instead returns a restricted verification token with requires_login_with_skor: true. Pass that token to the SDK in the same way: the iframe asks the tenant to Login with SKOR and verify a one-time code. After successful verification, SKOR links the key and displays Profile linked. If the profile is incomplete, a Continue onboarding action appears; selecting it redirects the tenant to onboarding and resumes from their stored step. If the profile is outdated, a Redo onboarding action appears instead and restarts the iframe onboarding flow. A current completed profile does not show either action. Later sessions for that tenant and key can use the normal onboarding token without another OTP. The restricted token does not log the tenant into SKOR or expose a tenant login token. For an existing incomplete tenant, onboarding_status and consent_status remain PENDING after OTP; consent changes to accepted only after onboarding is completed. For an existing current tenant, onboarding_status remains COMPLETED, while pending application consent is accepted after OTP verification. If the profile is outdated, the same OTP flow first displays Profile linked, followed by a Redo onboarding action. That action restarts the normal iframe onboarding flow; the session completes only after the renewed profile is saved. If consent was already accepted and the profile is current, SKOR returns token: null.

An administrator can optionally enable application profile management for an API key. In this SDK-only mode, Generate Tenant Onboarding Token starts a session for the lead tenant, who can complete each participant’s profile from one iframe. Existing profiles require email-code verification before they are linked. New or incomplete profiles continue through onboarding, while outdated profiles restart onboarding. The iframe shows every participant’s progress and closes only after all profiles are complete and the lead submits the application. Contact your SKOR administrator to enable or change this setting.

2. Using the SDK — launch the session

Call startProfileSession with the onboarding token and the id of the container element that should host the session.

const profileSessionInstance = sdk.startProfileSession({
  token, // token returned by the Generate Tenant Onboarding Token API
  containerId: "skor-container",
  height: "800px",
});

The SDK automatically tracks the session’s progress (via Tenant Profile Status) and drives the callbacks below. You do not need to call the status endpoint yourself. When normal onboarding is completed, or an existing current tenant successfully verifies the OTP and accepts application consent, the iframe displays a confirmation and posts a TENANT_ONBOARDING_COMPLETED browser message to the SDK. For an outdated profile, OTP verification alone does not post the completion message or close the iframe; the message is posted after the tenant finishes the restarted onboarding flow. The SDK consumes this message, closes the iframe, and invokes onSkorAnalysisRunning. Status polling remains active as a fallback if the browser message is not received. This browser message is separate from webhook delivery. If a webhook is registered for the modular API key, the backend also sends a signed TENANT_ONBOARDING_COMPLETED webhook with the completed tenant ID.

Landlord report session

Show the landlord report for a specific property and application. It uses the same Skor({ clientId }) setup as a tenant session, but the report requires both a propertyId and an applicationId in addition to the landlord token.

1. Using the API — generate a landlord token

Use your API access token. No request body is required.

Production
Sandbox

curl "https://api.skortorent.com/api/v1/landlords/token" \
  -H "Authorization: Bearer $SKOR_ACCESS_TOKEN"

curl "https://dev-api.skortorent.com/api/v1/landlords/token" \
  -H "Authorization: Bearer $SKOR_ACCESS_TOKEN"

Keep the token and the propertyId (from the Property Management API) and applicationId (from POST /applications/create-application) you want to display.

2. In the browser — show the report

Add a container to your page:

<div id="skor-container"></div>

Then start the session. Both propertyId and applicationId are required — the SDK will not render the report if either is missing.

const landlordSession = sdk.startProfileSession({
  token, // from your server
  containerId: "skor-container",
  propertyId: "YOUR_PROPERTY_ID", // required
  applicationId: "YOUR_APPLICATION_ID", // required
  height: "700px", // optional
});

The SDK embeds the report automatically. Standard callbacks (onLoad, onError, onCancel) and the height option work the same as for tenant sessions.

Use the exact propertyId and applicationId returned by the API. If either value is empty or mismatched, the session will fail to load.

`height`

The height property controls the height of the embedded iframe. It accepts either a CSS height value or a number:

CSS height values such as "500px", or "800px"
A number, which is treated as pixels, such as 600

If height is not provided, it defaults to 500px.

const profileSessionInstance = sdk.startProfileSession({
  token,
  containerId: "skor-container",
  height: "800px",
});

Callbacks

You can provide callback functions to handle events during the profile session.

`onLoad`

Triggered when the profile session loads successfully.

onLoad: () => {
  console.log("Profile Session loaded");
};

`onSkorAnalysisRunning`

Triggered when profile registration is complete and SKOR analysis is running. During this time, you may want to show a loader because the profile session UI cannot be shown until analysis is complete.

onSkorAnalysisRunning: () => {
  console.log("Skor Analysis is currently running");
};

`onCancel`

Triggered when the user cancels the profile session or when the cancel method is called.

onCancel: () => {
  console.log("Profile Session Cancelled");
};

`onError`

Triggered when an error occurs during the profile session.

onError: (error) => {
  console.log("Profile Session error", error);
};

`onProfileReady`

Triggered when the profile session is ready to be used.

onProfileReady: () => {
  console.log("Profile Session ready");
};

Review the Authentication guide before using the SDK in production.

Guides

SDK

API's Authentication

Modular API Guide

Modular API Reference

Property Management Guide

Property Management API Reference

Installation

Initialize

Start a profile session

1. Using the APIs — generate an onboarding token

2. Using the SDK — launch the session

Landlord report session

1. Using the API — generate a landlord token

2. In the browser — show the report

`height`

Callbacks

`onLoad`

`onSkorAnalysisRunning`

`onCancel`

`onError`

`onProfileReady`

​Installation

​Initialize

​Start a profile session

​1. Using the APIs — generate an onboarding token

​2. Using the SDK — launch the session

​Landlord report session

​1. Using the API — generate a landlord token

​2. In the browser — show the report

​height

​Callbacks

​onLoad

​onSkorAnalysisRunning

​onCancel

​onError

​onProfileReady

Installation

Initialize

Start a profile session

1. Using the APIs — generate an onboarding token

2. Using the SDK — launch the session

Landlord report session

1. Using the API — generate a landlord token

2. In the browser — show the report

`height`

Callbacks

`onLoad`

`onSkorAnalysisRunning`

`onCancel`

`onError`

`onProfileReady`