Frequently asked questions

No. Auto-approval means every automatic check passed, which are heuristics. It does not prove the document is authentic. See limits and calibration.

The session page and the webhook data.reasons list each cause: an editing-software trace, a face score below threshold, a failed selfie quality check, an AML hit, a duplicate image or ID, or a side score under the minimum.

Files are identified by their real content, and only photos are accepted. A PDF or flatbed scan is easier to edit and cannot be judged for glare or blur the same way, so the applicant is asked to photograph the card.

Only if your deployment relaxes the default frame and camera headers. The default sends X-Frame-Options: DENY. Redirecting is the supported path. See the website guide.

Yes in production. Browsers only allow camera access on HTTPS pages, and on localhost for development.

English, French and Arabic (with right-to-left layout). Pass language in the init call, or let it be detected from the browser.

Each event is retried immediately, then after 2 s, 10 s and 60 s. After that it is not re-queued, so reconcile with GET /info for sessions that do not progress.

The App secret key. If the session has no app, the company API key is used.

Extracted data is kept in memory only and removed after the first fetch (or after the ephemeral TTL). Store what you need on your side. See the privacy guide.

They can start new sessions. To limit it, set checkCINUniqueness: an ID number already verified for your company is refused with 409. Without it, the repeat is flagged for review.

Yes. A reviewer can change an approval to a decline or the reverse. Each decision is recorded with who made it.

Yes. npm run dev:local runs with mocked AI and local storage. See the local mode guide, or the demo.

This documentation makes no certification or compliance claims. Check with the vendor operating your deployment for anything you need to show a regulator.