Skip to content
Konnect ID Docs
Guide · Developer · 6 min

Integrate with a website (iframe/redirect)

Create a session on your server and send the user to the hosted flow.

The hosted flow lives at the verificationUrl returned by POST /api/session/init. Your backend creates the session; the browser only ever sees the URL.

  1. Create the session on your serverCall /api/session/init with your API key and keep session.sessionId next to your own record.
  2. Redirect the userSend a 302 (or set window.location) to verificationUrl. The user completes the flow on the Konnect ID domain, over HTTPS, with full camera access.
  3. Come backKonnect ID does not navigate the user back automatically. Show a waiting page on your side and rely on the webhook (or poll /info from your server) to learn the outcome.
Express route
app.post("/start-kyc", async (req, res) => {
  const r = await fetch(`${process.env.KONNECT_BASE_URL}/api/session/init`, {
    method: "POST",
    headers: { "x-api-key": process.env.KONNECT_API_KEY, "Content-Type": "application/json" },
    body: JSON.stringify({ clientId: "acme", flow: "KYC", applicationId: req.user.id }),
  });
  const { verificationUrl } = await r.json();
  res.redirect(verificationUrl);
});

Embedding in an iframe

Check your headers first

By default the app sends X-Frame-Options: DENY and Permissions-Policy: camera=(self). With those headers a browser will refuse to render the flow inside another site's iframe, and would block the camera there anyway. Embedding only works if your deployment relaxes them (for example a Content-Security-Policy: frame-ancestors allow-list for your domain and a camera permission for it). If you cannot change the deployment, use the redirect.

If you do control the headers, embed with the camera permission delegated:

html
<iframe src="VERIFICATION_URL" allow="camera" style="width:100%;height:720px;border:0"></iframe>
HTTPS

Both your page and the flow must be served over HTTPS for the camera to work (localhost is exempt for development).