Verification, live in an afternoon.
Drop in one SDK — Web, iOS or Android — and launch a fully managed document, face and liveness flow. The same configure → launch → result contract on every platform.
One API, three platforms
Web, iOS and Android share the same model: configure a session, launch a flow, receive one terminal result. Learn it once.
~3.6 KB, zero dependencies
The web SDK is a tiny, framework-agnostic module with first-class TypeScript types and no runtime dependencies.
Create or Token mode
Start fast with a public key, or mint a session token on your server (Token mode) to keep credentials off the client entirely.
Hosted modal or inline
Launch a polished modal flow, or embed the verification UI inline in your own container. The capture experience is fully managed.
Pick your platform.
Web
npm · v0.1.0- ESM & CommonJS
- TypeScript types included
- Framework-agnostic
iOS
SPM · iOS 15+- Swift Package Manager
- SwiftUI & UIKit
- Swift 5.9+
Android
Gradle · minSdk 24- Jetpack Compose
- Kotlin 2.0
- Java 17
Three required fields, one call.
import { OthentoSDK } from '@othento/web-sdk';
const sdk = new OthentoSDK({
mode: 'create',
apiKey: 'pk_sandbox_•••',
workflowExternalId: 'wf_onboarding',
clientData: 'user-123',
onCompleted: ({ decision, externalId }) => {
// 'Approved' | 'Declined' | 'InReview'
console.log(decision, externalId);
},
onCancelled: ({ reason }) => console.log('cancelled', reason),
onError: (err, message) => console.error(err.code, message),
});
sdk.start();Two ways to start a session.
Fastest to integrate
Configure the SDK with a public key, your workflowExternalId and a clientData identifier. The SDK mints the session for you. Ideal for prototypes and trusted environments.
Recommended for production
Mint a session access token (sat) on your server and pass it to the SDK. No API keys ever reach the client — your backend stays the single source of trust.
The session config.
| Option | Type | Required | Description |
|---|---|---|---|
| mode | 'create' | 'token' | Required | Start a new session (create) or resume a server-minted one (token). |
| apiKey | string | Optional | Public key. pk_sandbox_… for testing, pk_live_… for production. |
| workflowExternalId | string | Optional | The verification workflow to run for this session. |
| clientData | string | Optional | Your end-user identifier — echoed back on events and webhooks. |
| sat | string | Optional | Server-minted session access token; keeps API keys off the client. |
| expectedDetails | object | Optional | Pre-filled identity hints (name, DOB, nationality, document number…). |
| callbackUrl | string | Optional | Webhook / redirect URL for terminal session notifications. |
| metadata | string | Optional | Free-form string round-tripped on session events and webhooks. |
Web presentation options
| container | HTMLElement | string | Render inline in your element instead of a modal (CSS selector or node). |
| showCloseButton | boolean | Modal only. Hide the × button when your UI provides dismissal. |
| closeOnBackdropClick | boolean | Modal only. Treat a backdrop click as a cancellation. |
One terminal result, always.
The flow has loaded and the handshake is complete. Fires once, first.
ProgressA session was minted — persist the externalId against your user record.
ProgressThe session moved through Created → InProgress → Processing.
ProgressVerification reached a decision: Approved, Declined or InReview.
TerminalThe user dismissed or cancelled the flow before a decision.
TerminalA non-decision terminal error (e.g. network, camera permission).
TerminalonCompleted.
onStatusChange.
Safe by construction.
Biometrics never touch your servers
Document images and selfies are captured and uploaded directly to Othento — they never cross the host page or your backend, shrinking your compliance scope.
Origin-checked messaging
The web SDK talks to a fixed, hard-coded origin and verifies the sender on every message; a protocol mismatch surfaces as a clear error.
Least-privilege public keys
Public keys can only mint sessions and read their own data. Use Token mode to keep even those off the client and mint sessions server-side.
Ready to build?
Get sandbox keys and a workflow ID, and ship a verification flow this week.