Investor Website

Dev URL: https://dev.tokenise.io
The Investor Website is the main broker interface used by end-users (investors).
After accessing the website and creating an account, users can:
- Register and log in
- Complete KYC (identity verification) through the integrated compliance flow
- View available assets and investment products
- Place trades / orders
- See their portfolio and balances
- View order history and past activity
In short, this is the environment where investors interact with Tokenise-Broker: from onboarding (KYC) to trading and monitoring their investments.
Technology
The Investor Website is built using React and Next.js.
This gives us a modern, component-based front-end with server-side rendering (SSR) and good performance, while keeping the codebase easy to maintain and extend over time.
Login & Authentication
Login and registration are handled via the VERO social login system.
- The Investor Website collects the user’s credentials (username/password or social login) and sends them to VERO.
- VERO validates the credentials and returns an access token.
- From this point on, every request from the Investor Dashboard to Backend-Core includes this token in the request headers.
- Backend-Core verifies the token with VERO on each request.
User identification in Backend-Core:
- If the user already exists in the Broker Core database, they are recognised as a broker user.
- If the user does not exist yet, they are stored as a VERO user with a unique veroId.
- In both cases, as long as the VERO token is valid, Backend-Core treats the session as authenticated and returns the appropriate data for that user.

Registration
For registration, the Investor Website does not talk to Backend-Core directly.
- The front-end communicates with the VERO app to collect and submit the user’s details.
- VERO creates the user account and, if successful, returns control to the Investor Website.
- After a successful registration, the user is automatically logged in and an access token is issued by VERO.
- From that point on, the flow is the same as the normal login: the access token is sent in the headers to Backend-Core with each request and is verified on every call.
