The Checktiv Web SDK (`@checktiv/sdk-web`) lets you embed identity verification directly in your own app. The client surface is two lines: `Checktiv.init(...)` to configure the SDK, then `.mountProvisioned(...)` to render the verification experience. A complete integration also requires roughly four backend touchpoints: minting a session via the public API, minting a `bt_*` browser token, verifying webhook signatures on your server, and registering your publishable-key origin.

## What the SDK gives you

- **Managed IDV module** - camera capture, liveness detection, and document scan rendered inside your page. The verification journey runs in a sandboxed iframe; your page never touches the raw capture data.
- **Consent-gated fraud module** - passive signal collection that starts only after the applicant grants consent.
- **React wrapper** - `<ChecktivProvider>` and `<ChecktivIdv>` for React and Next.js apps.
- **White-label theming** - set `primaryColor` at `init()` time; the journey inherits your brand color. Brand your own page layout around the SDK embed for logos.

## Install

Via npm:

```bash
npm install @checktiv/sdk-web
```

Via CDN script tag (IIFE, no bundler required):

```html
<script src="https://sdk.us.checktiv.com/v1/sdk.js" crossorigin="anonymous"></script>
```

This loads the latest release automatically. After the script tag loads, the SDK is available as `window.Checktiv`.

For production deployments, pin to a specific version and include a Subresource Integrity hash to guard against CDN compromise. SRI is only coherent on the immutable pinned URL, not the moving `/v1/sdk.js` pointer. See [Versioning](/developers/sdks/versioning) for the pinned URL shape and how to get the SRI hash from the [release notes](/developers/sdks/release-notes).

## The two-line client surface

```js
const client = Checktiv.init({
  publishableKey: 'ah_pk_us_test_...',
  getSessionToken: async (ctx) => {
    const res = await fetch('/api/checktiv/token', { method: 'POST' });
    return (await res.json()).token;
  },
});

client.mountProvisioned({ target: document.getElementById('idv-container') });
```

`init()` never contacts a network; `mountProvisioned()` fetches the server-declared session modules and renders them. The secret key used to mint the session stays on your server.

## Backend touchpoints

Before the SDK renders, your backend must:

1. **Create a session** via `POST /v1/sessions` with your secret key (`ah_sk_...`). See the [API reference](/reference).
2. **Mint a browser token** (`bt_*`) via `POST /v1/sessions/:id/browser_token`. The SDK calls `getSessionToken` whenever it needs a fresh token.
3. **Register allowed origins** for your publishable key so the SDK can load on your domain. See [API keys](/developers/api-keys).
4. **Receive the verdict via webhook**. The `checktiv.idv.submitted` event on the SDK signals capture is complete; the authoritative outcome arrives on your server as a `kyc.session.*` webhook. See [Verdict and webhooks](/developers/sdks/verdict-and-webhooks).

## Guides

- [Quickstart](/developers/sdks/quickstart) - end-to-end integration walkthrough
- [Modules overview](/developers/sdks/modules) - the full public surface and how each subpath is registered
- [Token handoff](/developers/sdks/token-handoff) - how sessions and browser tokens work
- [React](/developers/sdks/react) - `ChecktivProvider` and `<ChecktivIdv>`
- [Custom forms](/developers/sdks/custom-forms) - render author-defined intake fields in the journey
- [Cross-device handoff](/developers/sdks/cross-device) - let a desktop applicant continue on their phone
- [Advanced capture](/developers/sdks/capture) - build a custom capture renderer on the Tier-1 / Tier-2 core
- [Theming](/developers/sdks/theming) - brand colors and logo
- [Error reference](/developers/sdks/error-reference) - every error code with recovery steps
- [Verdict and webhooks](/developers/sdks/verdict-and-webhooks) - receiving the outcome securely
- [Versioning](/developers/sdks/versioning) - pinning, compatibility, and evolution contract
- [Secret key rotation](/developers/sdks/sk-key-rotation) - rotate or revoke `ah_sk_*` safely
- [Fraud consent](/developers/sdks/fraud-consent) - consent gating for the fraud module

## REST API

You can also use the REST API directly without the SDK. See the [API reference](/reference) and the [REST quickstart](/developers/quickstart).