Backend integration guide

Verification portals

A portal is a hosted verification page you configure once and send to people. Create one in Dashboard, Portals. Choose the steps it includes: an identity document (front and back), a selfie, the live face check, and optionally an assessment.

People who would rather not have their face scanned can choose to use their ID instead when the portal uses the face-then-document method. The result tells you the face scan was declined.

Set the age check for the portal: the method (face estimate, ID document, or face estimate that falls back to an ID document when the face result is not conclusive), the minimum age, and the confidence level (standard 90% or high 97%).

Add your display name, accent colour and an introduction, an optional return address the person is sent to afterwards, and an optional webhook address. When you save, the webhook signing secret is shown once; store it on your server.

Each verification starts with a session created from your server with your API key, which returns a single-use link. The person opens it, agrees to the processing, and completes the steps. You receive pass, fail or review on your webhook, signed so it cannot be forged. The return address never carries the result, because a URL can be edited.

Embedding a portal on your website

On Growth plans and above you can embed a portal inside your own page instead of linking to it. Add the domains allowed to embed it in the portal settings, then paste the snippet shown under Embed. The verification still runs on our pages inside a secure frame, so your site cannot read the camera feed, change a step or alter a result. Results still arrive only on your signed webhook.

API keys

Create keys in Dashboard, API keys. A key is shown once, so copy it to your server straight away; we only keep a hash and cannot show it again. You can restrict a key to a list of IP addresses and give it an expiry date. Revoke a key immediately if it may have been exposed.

Send the key as a bearer token in the Authorization header. Requests that include a person's images must also send X-End-User-Consent: true, confirming that person was told how their data is processed and agreed. Never put a key in browser or mobile app code.

The Docs page lists every endpoint with parameters and example responses, and the Backend guide shows complete server examples.