SDKs

The Checktiv Web SDK (@checktiv/sdk-web) lets you embed identity verification directly in your own app. The client surface is two lines: Checktiv.init(...) to configure the SDK, then .mountProvisioned(...) to render the verification experience. A complete integration also requires roughly four backend touchpoints: minting a session via the public API, minting a bt_* browser token, verifying webhook signatures on your server, and registering your publishable-key origin.

What the SDK gives you

• Managed IDV module - camera capture, liveness detection, and document scan rendered inside your page. The verification journey runs in a sandboxed iframe; your page never touches the raw capture data.
• Consent-gated fraud module - passive signal collection that starts only after the applicant grants consent.
• React wrapper - <ChecktivProvider> and <ChecktivIdv> for React and Next.js apps.
• White-label theming - set primaryColor at init() time; the journey inherits your brand color. Brand your own page layout around the SDK embed for logos.

Install

Via npm:

npm install @checktiv/sdk-web

Via CDN script tag (IIFE, no bundler required):

<script src="https://sdk.us.checktiv.com/v1/sdk.js" crossorigin="anonymous"></script>

This loads the latest release automatically. After the script tag loads, the SDK is available as window.Checktiv.

For production deployments, pin to a specific version and include a Subresource Integrity hash to guard against CDN compromise. SRI is only coherent on the immutable pinned URL, not the moving /v1/sdk.js pointer. See Versioning for the pinned URL shape and how to get the SRI hash from the release notes.

The two-line client surface

const client = Checktiv.init({
  publishableKey: 'ah_pk_us_test_...',
  getSessionToken: async (ctx) => {
    const res = await fetch('/api/checktiv/token', { method: 'POST' });
    return (await res.json()).token;
  },
});

client.mountProvisioned({ target: document.getElementById('idv-container') });

init() never contacts a network; mountProvisioned() fetches the server-declared session modules and renders them. The secret key used to mint the session stays on your server.

Backend touchpoints

Before the SDK renders, your backend must:

1. Create a session via POST /v1/sessions with your secret key (ah_sk_...). See the API reference.
2. Mint a browser token (bt_*) via POST /v1/sessions/:id/browser_token. The SDK calls getSessionToken whenever it needs a fresh token.
3. Register allowed origins for your publishable key so the SDK can load on your domain. See API keys.
4. Receive the verdict via webhook. The checktiv.idv.submitted event on the SDK signals capture is complete; the authoritative outcome arrives on your server as a kyc.session.* webhook. See Verdict and webhooks.

Guides

• Quickstart - end-to-end integration walkthrough
• Modules overview - the full public surface and how each subpath is registered
• Token handoff - how sessions and browser tokens work
• React - ChecktivProvider and <ChecktivIdv>
• Custom forms - render author-defined intake fields in the journey
• Cross-device handoff - let a desktop applicant continue on their phone
• Advanced capture - build a custom capture renderer on the Tier-1 / Tier-2 core
• Theming - brand colors and logo
• Error reference - every error code with recovery steps
• Verdict and webhooks - receiving the outcome securely
• Versioning - pinning, compatibility, and evolution contract
• Secret key rotation - rotate or revoke ah_sk_* safely
• Fraud consent - consent gating for the fraud module

REST API

You can also use the REST API directly without the SDK. See the API reference and the REST quickstart.