Choose an integration
Every Assayra integration uses the same secure pattern:
- Your backend creates an application with a tenant API key.
- Assayra returns a scoped applicant invitation URL.
- Your frontend or mobile app uses only that invitation—never the tenant API key.
- Your backend verifies webhooks and reads the final application state.
Download the current SDK release before following a platform guide.
Choose the experience
| Mode | Best for | You build | Assayra manages | Typical effort |
|---|---|---|---|---|
| Hosted redirect | Fastest first integration | Start button and completion page | The entire applicant journey | Hours |
| Drop-in hosted | Verification inside your page/app | Container, navigation and surrounding UI | Journey, capture and recovery UI | 1–2 days |
| Headless | Fully custom experience | Every screen, state and recovery path | Session order, evidence and decision controls | Multi-week |
Start with hosted redirect unless keeping the applicant inside your interface is a firm requirement. Choose drop-in hosted for an embedded experience without taking ownership of protected capture UX. Choose headless only when your team can test camera, accessibility, recovery and workflow variants continuously.
Choose the SDK
| SDK | Hosted redirect | Drop-in hosted | Headless | Native integrity | Passport NFC |
|---|---|---|---|---|---|
| Web | Yes | iframe mount | Browser client | Browser signals | No |
| iOS 15+ | Yes | SwiftUI/WKWebView | Async Swift client | App Attest | CoreNFC / ICAO 9303 |
| Android API 26+ | Custom Tab | Android View | Kotlin coroutines | Play Integrity | Android NFC / ICAO 9303 |
| React Native 0.74+ | External browser | Secure WebView | TypeScript client | Native adapter | Native adapter |
Security boundary
Never place a Sandbox or Live API key in JavaScript delivered to a browser, a mobile bundle, source control, logs or analytics. Browser and mobile code receive only the opaque token from the issued applicant URL. If that URL is exposed, revoke or regenerate its invitation from the tenant API.
Environments
- Use a
pl_sandbox_…key for development and automated tests. - Use a
pl_live_…key only from the production backend after Live activation. - Store separate base URLs, keys, webhook secrets and workflow IDs for Sandbox and Live.
- Never point a production build at a Sandbox workflow or copy an applicant token between environments.
Completion is server-to-server
Hosted SDKs emit proofline.ready, proofline.step, proofline.complete and proofline.error. These wire identifiers remain stable for version 1 compatibility. They are protocol constants, not display branding.
Use the completion event to move the applicant to a pending screen. Use a verified webhook followed by an authenticated GET /v1/applications/{id} request as the source of truth for approval or rejection.
Version and upgrade policy
Pin an exact SDK version and commit the downloaded artifact or an approved internal mirror to your dependency store. Before upgrading:
- Compare the release notes and checksum.
- Test every enabled workflow in Sandbox.
- Test supported browsers/devices, permission denial and interrupted uploads.
- Confirm your webhook consumer accepts additive fields.
- Roll out progressively and retain the previous artifact for rollback.
Each SDK exposes the public capability registry (capabilities() or capabilities.list()). A production pipeline should stop if a required module is absent, not liveEligible, or outside the documented supported scope.