``` --- ## Add permissions ### Content Security Policy In order to improve security, add the following CSP directives headers to `index.html `file, under the `<meta>` tag: ```plaintext Content-Security-Policy default-src 'self' *.veriff.me *.veriff.com; script-src 'self' *.veriff.me *.veriff.com *.hotjar.com *.probity.io; img-src blob: 'self' *.probity.io; frame-src 'self' *.hotjar.com; connect-src 'self' *.veriff.com *.veriff.me *.probity.io; style-src 'self' *.veriff.com *.veriff.me; ``` For example: ```xml ``` ### Camera access To avoid any issues, make sure that you allow Veriff to request camera access. If your Permissions Policy denies camera requests by default, you may encounter issues when using the InContext SDK. For more information, please read the [W3C Permissions Policy Explainer](https://github.com/w3c/webappsec-permissions-policy/blob/main/permissions-policy-explainer.md)[↗] . --- ## Start the verification flow You need to pass the `sessionURL` from the verification session that you started with either [POST /sessions](https://devdocs.veriff.com/apidocs/v1sessions) API call or using the [JavaScript SDK](/v1/docs/javascript-sdk-1). #### **Step 1: create a session** You have two options to create a session: 1. Use the [POST /sessions](https://devdocs.veriff.com/apidocs/v1sessions) public API call 2. Use Veriff’s [JavaScript SDK](/v1/docs/javascript-sdk-1) to start a session In order to start a session, you need to find your API keys and the `base URL`. See the [API Documentation and reference](https://devdocs.veriff.com/apidocs) article in the Veriff API documentation. The minimum contents of the POST /sessions request is: ```curl {"verification": { "callback": "https://veriff.com", "vendorData": "11111111" } } ``` Note that even the `vendorData` field is optional. Nonetheless, Veriff strongly recommends you create and store end-user IDs for your end-users, and pass those to Veriff using the `vendorData` parameter. See the [Glossary](https://veriff-dev-documentation.document360.io/docs/glossary-overview) for more info about the `vendorData`. #### **Step 2: pass the sessionURL** Use the following function: ```javascript const veriffFrame: const veriffFrame = createVeriffFrame({ url: VERIFF_SESSION_URL }) ``` #### What happens after the end-user leaves the flow? When the end-user leaves the verification flow, i.e. a session is canceled or finished, the Veriff SDK is closed. The end-user is taken back to your application. The **end-user flow completion status** is returned to the host application, see [Verification session status](/v1/docs/incontext-sdk-1#verification-session-status) section below for more info. --- ## Verification session status When a session is cancelled or finished, the InContext SDK emits the `CANCELED` or `FINISHED` events. It is up to you to decide what happens (close, redirect) in the SDK when the events are triggered. You can capture the end-user flow status, to do this, pass `onEvent` callback function when initializing the SDK. > [!NOTE] > **This is not the verification session decision.** > > This indicates whether the end-user was able to complete all the steps in the verification flow or not. ```javascript import { createVeriffFrame, MESSAGES } from '@veriff/incontext-sdk'; createVeriffFrame({ url: VERIFF_SESSION_URL onEvent: function (msg: MESSAGES) { switch (msg) { case MESSAGES.STARTED: console.log('Verification started'); break; case MESSAGES.SUBMITTED: console.log('Verification submitted'); break; case MESSAGES.FINISHED: console.log('Verification finished'); break; case MESSAGES.CANCELED: console.log('Verification closed'); break; case MESSAGES.RELOAD_REQUEST: console.log('Verification reloaded'); break; } }, }); ``` In the example above, the `CANCELED` message was emitted. Options are: - `STARTED` - indicating that the session status has been changed to started - `FINISHED` - indicating that the end-user completed the verification flow and closed the modal - `CANCELED` - indicating that the end-user abandoned the verification flow and closed the modal - `SUBMITTED` - fires when verification data is submitted, enabling progress tracking npm - `RELOAD_REQUEST` - essential for handling camera permission recovery scenarios --- ## Verification session decision Veriff returns info about the verification session decision, extracted data, registries checks etc via **webhooks**. You need to set up webhooks and tie them to your system. → *See Webhooks Guide > [Set up webhooks](https://veriff-dev-documentation.document360.io/docs/webhooks-guide#set-up-webhooks) sub-section for detailed overview of the setup process* --- ## Customize the SDK > [!NOTE] > SDK customization is optional It is possible to configure a number of elements with the following function: ```javascript createVeriffFrame([options]) ``` The `[options]` can be replaced with following functions to customize the SDK: - `url`*- specify the verification session URL - `lang` - set the user interface language to a [supported language](https://devdocs.veriff.com/docs/sdk-guide#supported-languages) - `onEvent` - specify what happens when the `onEvent` [function is triggered](/v1/docs/incontext-sdk-1#how-to-get-verification-session-status) - `onReload` - set up the `onReload` [request callback](/v1/docs/incontext-sdk-1#define-onreload-function) to handle webpage reloading and SDK reopening - `embedded` - set to `true` if you want to use [embedded mode](/v1/docs/incontext-sdk-1#using-the-embedded-mode) - `embeddedOptions` - embedded mode options - `rootElementID` - specifies the parent document object model (DOM) element of Veriff’s iframe, using its ID attribute *Required ### Define `onReload` function This is an edge case for Safari iOS to re-request camera permissions, to handle the situation when the end-user has denied camera access and now the access to the host page needs to be requested again and the page needs to be reloaded again. ```javascript const url = sessionStorage.getItem('@veriff-session-url') || getSessionUrl() veriffSDK.createVeriffFrame({ url, onReload: () => { // Logic to re-open Veriff SDK after page reload // e.g. sessionStorage.setItem('@veriff-session-url', url); window.location.reload(); }, }); ``` ### Define .`close()` function for Veriff modal Normally, the Veriff end-user view (modal) is closed according to the end-user input, but you can use the function below to control it (e.g. set up timeout): ```javascript veriffFrame.close(); ``` --- ## Changelog | Date | Description | | --- | --- | | Sep 2, 2026 | Code examples in Note about dimensions updated | | Dec 8, 2025 | Versioning updated from v1 to v2.5.0 | | Jun 6, 2025 | Note added to the [Embedded mode section](/v1/docs/incontext-sdk-1#using-the-embedded-mode) explaining that the mode is disabled on mobile devices to prevent UI/UX degradation Header “Article versioning” renamed to “Changelog” | | May 28, 2025 | From [Embedded mode](/v1/docs/incontext-sdk-1#using-the-embedded-mode), removed the note about a certain feature flag enablement, as that step in configuration is redundant | | May 15, 2025 | Link to [Embedding in Android and iOS WebViews](/v1/docs/embedding-in-android-and-ios-webviews-1) added | | Mar 28, 2025 | Broken link fixed | | Mar 12, 2025 | Documentation published | A **process where the end-user submits the data** required to get verified. Also referred to as the "end-user flow". ## Related - [Create verification session](/how-to-generate-sessions-manually.md) - [Intro to the API](/quick-guide-of-idv-using-the-api.md) - [Webhooks Guide](/webhooks-guide.md) - [Backwards compatible changes](/backwards-compatible-changes.md) - [JavaScript SDK](/javascript-sdk-1.md)