Identity verification platform (now Entrust Identity Verification) — document + biometric checks orchestrated via Onfido Studio workflows with Web, iOS, Android, React Native, and Flutter SDKs.
- 01document + biometric KYC
- 02Studio workflow orchestration
- 03global IDV
- 04mobile-first onboarding
- 05regulated fintech / crypto KYC
- pnpm add onfido-sdk-ui
| Variable | Scope | Description |
|---|---|---|
| ONFIDO_API_TOKEN | Server | Onfido API token (region-scoped, e.g. `api.eu.onfido.com`) for server-side calls. |
| ONFIDO_REGION | Server | Region of your Onfido tenant (`eu`, `us`, or `ca`) — must match the API base URL. |
| ONFIDO_WEBHOOK_TOKEN | Server | Shared webhook signing token used to verify the X-SHA2-Signature header on Onfido webhooks. |
Use Onfido (Entrust Identity Verification) for KYC orchestrated via Onfido Studio. Server-side, create an applicant with `POST https://api.{region}.onfido.com/v3.6/applicants` (Bearer `ONFIDO_API_TOKEN`), then create a workflow run with `POST /v3.6/workflow_runs` referencing your `workflow_id` from Studio. The response payload includes an `sdk_token` scoped to that workflow run; pass it to the browser and initialize `Onfido.init({ token, workflowRunId, containerId, onComplete, onError })`. Do not trust `onComplete` for decisioning — wait for the `workflow_run.completed` webhook, verify `X-SHA2-Signature` (HMAC-SHA256 of the raw body keyed with `ONFIDO_WEBHOOK_TOKEN`), and read the workflow output (`status`, `output.decision`, breakdowns) from `GET /v3.6/workflow_runs/{id}`.
- ⚑SDK tokens are scoped to a single workflow run and expire after ~5 weeks — do not cache them across sessions and never embed long-lived tokens in your bundle.
- ⚑API region is sticky (eu/us/ca) — applicants created in EU cannot be read from the US base URL, so pick region for data residency upfront.
- ⚑Document and country coverage is broad but uneven — Studio lets you branch by country, so build explicit fallbacks (passport-only, manual review) for thin-coverage corridors instead of a single happy path.
- ⚑Webhook signature is HMAC-SHA256 of the raw body — verifying after JSON parse-and-restringify will fail. Always verify the raw bytes.
- ⚑Sandbox uses fixture decisions triggered by special test document images — never measure approval or fraud rates against sandbox.
- ⚑Liveness rejection rates rise on low-end mobile cameras and bad lighting — instrument retries and consider Studio branching (passive then active liveness).
- ⚑Data retention is configurable per contract — pull audit artifacts (images, reports) before retention expiry, and align with GDPR/UK DPA disclosures.
- ⚑The product is being rebranded as Entrust Identity Verification; older docs may reference Onfido domains while newer SDKs ship under the Entrust namespace.