React Native SDK

Package: @assayra/react-native 1.0.0
Peer requirements: React 18+, React Native 0.74+ and react-native-webview 13.10+

1. Download and install

1. Download assayra-react-native-1.0.0.tgz.
2. Verify it against SHA256SUMS.
3. Place it at vendor/assayra-react-native-1.0.0.tgz inside your app repository.
4. Install the package and its WebView peer dependency:

npm install ./vendor/assayra-react-native-1.0.0.tgz react-native-webview

For Expo:

npm install ./vendor/assayra-react-native-1.0.0.tgz
npx expo install react-native-webview

5. Install iOS pods from the React Native application:

cd ios
bundle exec pod install
cd ..

6. Confirm the package is pinned:

npm ls @assayra/react-native react-native-webview

The public npm package is not live yet; keep the verified tarball or an approved internal mirror available to CI.

2. Platform permissions

iOS Info.plist:

<key>NSCameraUsageDescription</key>
<string>We use the camera to capture your identity document and verify that you are present.</string>
<key>NFCReaderUsageDescription</key>
<string>We use NFC to read the security chip in supported identity documents.</string>

Android AndroidManifest.xml for custom native capture:

<uses-permission android:name="android.permission.CAMERA" />
<uses-permission android:name="android.permission.NFC" />
<uses-feature android:name="android.hardware.nfc" android:required="false" />

Request runtime permissions from a clear applicant action. The hosted WebView requests camera access through the operating system; native headless capture remains your application’s responsibility.

3. Receive a scoped token

Your backend creates the Assayra application. Return the opaque verification token only to the authenticated app session that owns it. Never ship a tenant API key in JavaScript, native constants, app configuration or over-the-air bundles.

Option A — embedded hosted view

import { AssayraVerificationView } from "@assayra/react-native";

export function VerificationScreen({ token }: { token: string }) {
  return (
    <AssayraVerificationView
      webOrigin="https://your-assayra-origin.example"
      verificationToken={token}
      onEvent={(event) => {
        if (event.type === "proofline.complete") {
          navigation.replace("VerificationPending", {
            reference: event.reference,
          });
        }
      }}
      onError={(event) => reportSafeCode(event.code)}
      style={{ flex: 1 }}
    />
  );
}

The WebView uses an ephemeral session, disables mixed content and third-party cookies, constrains navigation to the configured origin and validates every bridge event. The completion event is for navigation only; your backend webhook determines final state.

Option B — external hosted journey

import { AssayraReactNative } from "@assayra/react-native";

const assayra = new AssayraReactNative({
  webOrigin: "https://your-assayra-origin.example",
  verificationToken: token,
});

await assayra.launchHostedVerification();

Use this when you prefer the system browser and its current security/accessibility behavior. Do not infer completion merely because the app becomes active again; query your backend for status.

Option C — headless client

const assayra = new AssayraReactNative({
  webOrigin: "https://your-assayra-origin.example",
  verificationToken: token,
});

const session = await assayra.sessionStatus();
if (session.application.currentStep === "identity") {
  await assayra.submitIdentity(identity);
}

Headless methods include business/UBO, documents, guided liveness, ECDD evidence, wallet/attended handoffs, NFC session/completion and final consent. Re-read session state after resume or interruption and render only the permitted step.

React Native upload objects must provide a native URI, file name and supported MIME type:

await assayra.uploadDocument({
  uri: capture.uri,
  name: "identity-document.jpg",
  type: "image/jpeg",
});

4. Automatic face capture

For a custom camera, implement the exported camera adapter and use AssayraAutomaticCapture so the shared policy—not screen button taps—controls the centre/challenge/return sequence. The adapter must return a reduced observation JPEG and a full-quality evidence JPEG from the same camera instant.

The capture sequence:

1. Requests a fresh challenge.
2. Captures transient preview observations.
3. Displays the returned guidance.
4. Automatically retains evidence only after stable challenge-correct frames.
5. Collects exactly three fresh frames.
6. Obtains the native integrity token when configured.
7. Submits the evidence and returns the server response.

If you do not implement and test the native camera adapter, use AssayraVerificationView; it includes the managed capture experience.

5. Native integrity and NFC

Implement the exported integrity and NFC interfaces using platform-native code:

• iOS: App Attest/DeviceCheck and CoreNFC;
• Android: Play Integrity and Android NFC;
• return raw, hash-bound evidence through the typed interface;
• never convert a JavaScript/native diagnostic boolean into a pass.

Use a development client or bare build for custom native modules; Expo Go cannot host arbitrary App Attest/NFC native implementations.

6. Lifecycle and recovery

• Stop camera resources when the screen blurs or the app backgrounds.
• Keep only the scoped token and server-returned journey state needed to resume.
• Do not persist frames/documents in AsyncStorage, Redux persistence, logs or analytics.
• Handle camera denied, no camera, offline upload, expired invitation and pending manual review.
• On app resume, call sessionStatus() instead of replaying the last step.

7. Upgrade or remove

To upgrade, verify the new archive, replace the vendor file, reinstall, run pod install, rebuild both platforms, test every enabled workflow in Sandbox and commit the lockfile/Podfile changes.

To remove:

npm uninstall @assayra/react-native

Remove react-native-webview only if no other feature uses it, run pod install again, remove Assayra-only permissions and rebuild both apps.