Integration guide

How does VIS work?

From creating a session to receiving the result — a complete, clear view of the identification flow.

System architecture

Architecture overview

The mobile SDK only drives the flow. Your secret API credentials stay on your server, while VIS securely processes media and webhook results.

Security rule: the OAuth client secret is never stored in the mobile app.

  1. Your mobile app

    Launches the SDK

  2. Your backend

    Calls the REST API

  3. VIS platform

    Verifies and returns the result

Step by step

The complete verification flow

Every stage has a clear responsibility: secrets stay on the server, the SDK guides the user, and VIS returns the result.

  1. 01

    Your backend creates a session

    Your server gets an OAuth token with its client_id and client secret, then calls POST /api/sdk/v1/session/start with it. The response contains the attempt_id and a one-time bootstrap secret.

    Never store API credentials in the mobile app.

  2. 02

    Pass the secret to the mobile SDK

    Your backend passes the attempt_id and bootstrap secret to the app. The SDK binds the session to the device and signs later requests with DPoP.

    The bootstrap secret is valid for at most 5 minutes and can be used once.

  3. 03

    The SDK captures media

    The SDK opens the camera, guides the user and securely uploads the media through POST /api/sdk/v1/session/{attempt_id}/upload.

    JPEG and MP4, up to 20 MB per file.

  4. 04

    AI processes the checks

    Uploaded media is first validated in quarantine, then VIS runs liveness, document and face matching checks.

    Processing runs in a secure server environment.

  5. 05

    Get the result by query or webhook

    The SDK reads a coarse state from GET /api/sdk/v1/session/{attempt_id}/status. Your backend receives the final result from the partner API or a webhook.

    Webhooks are signed with Ed25519 following RFC 9421.

Reading the result

Understanding verification results

Every state has a colour, an icon and clear text — decisions never depend on colour alone.

  • Approved

    The liveness check passed and no forgery was detected.

  • Rejected

    The liveness check failed or the fraud risk is high.

  • Manual review

    There is not enough information for an automatic decision. Review the result manually.

  • Error

    A processing error occurred. Try the session again.