Incode WebSDK 2.0 Reference

The Incode Web SDK embeds identity verification — document capture, selfie liveness, phone/email OTP, eKYC, eKYB, and more — into any web application. It ships as web components, manager APIs, and a plug-and-play <incode-flow> element.

This wiki is for developers integrating with Incode's Platform using the Web SDK.

📘

This guide is specific to Web SDK 2.0. If you are still using 1.x, you can find documentation here. Contact your Incode Representative for upgrade information and check if you are a candidate for this upgrade.

Full rollout to all clients still TBD.

Start here

If you want to…	Go to
Get a working flow in 5 minutes	Getting Started
See every module the SDK exposes	Individual Modules
Use the all-in-one component	IncodeFlow Component
Build fully custom UI	Headless Mode
Customize colors and typography	Theming & Styling
Reference for the public API	API Reference
Solve a specific problem	Troubleshooting

How the SDK fits together

Browser

Your backend

createSession()

Path 3 — Headless

subscribe

createPhoneManager
createSelfieManager
createIdCaptureManager ...

Your UI
any framework

Path 2 — Orchestrator

ready / step state

createOrchestratedFlowManager

<incode-phone>
<incode-selfie>
<incode-id> ...

Path 1 — Drop-in

<incode-flow>
one element, full UI

API key + Configuration ID
(server-side only)

setup&(apiURL, token&)

Three integration paths, same SDK underneath. Pick the one that matches how much UI control you need:

Path 1: <incode-flow> drop-in. One web component, full SDK UI, ~5 lines of code. Best when standard branding works for you and you want fastest time-to-value.
Path 2: Orchestrator + module web components. You own the shell (landing page, transitions, completion screen). Incode owns each module's screen. ~30 lines of code.
Path 3: Headless Managers. You own everything — every screen, every transition. The SDK supplies state machines and business logic. ~50+ lines of code, maximum flexibility.

Three-package architecture

The SDK is split across three npm packages. Most integrations only need to depend on two of them:


Your app

@incodetech/web
L2 — UI components, CSS

@incodetech/core
L1 — managers, state machines, types

@incodetech/infra
L0 — internal browser/WASM bridge

@incodetech/web: UI components and CSS. Ships every consumer-facing element (<incode-flow>, <incode-phone>, <incode-selfie>, <incode-id>, …) as a standard Web Component plus the design-token CSS.
@incodetech/core: framework-agnostic SDK core. Contains setup(), createSession(), all module managers, all the public TypeScript types.
@incodetech/infra: internal layer. Do not import from this package directly. The SDK re-exports anything you need (e.g. warmupWasm lives at @incodetech/core/wasm).

Framework integration

Every Incode UI module ships as a standard Web Component — usable from vanilla HTML, React (with or without React 19's native custom-element support), Angular (CUSTOM_ELEMENTS_SCHEMA), and Vue 3 (compilerOptions.isCustomElement). The set-up is small but framework-specific.

What the SDK can do

Identity capture: government IDs, passports, driver's licenses, generic document capture, OCR extraction, face match against ID photos.
Liveness & biometrics: selfie capture in single-frame, multi-modal, and video-liveness modes (powered by Incode's Deepsight ML pipeline), face mask / lens / closed-eye / brightness validation.
Contact & consent: phone OTP, email OTP, mandatory and optional consent capture, geolocation capture.
Compliance & risk: antifraud signals, watchlists (sanctions, PEP), custom watchlists, business watchlists, government data validation, CURP validation (Mexico).
Signing: handwritten signature, electronic signature, AE signature, QE signature.
Composite flows: eKYC, eKYB, end-to-end orchestrated workflows configured from the Incode Dashboard, identity reuse, cross-document data matching.

Browser support

The SDK targets modern evergreen browsers — Chrome, Firefox, Safari, and Edge. The build emits ES2021 and uses getUserMedia, MediaRecorder, fetch, and WebAssembly; any browser that supports those (roughly Chrome ≥ 90, Firefox ≥ 88, Safari ≥ 14, Edge ≥ 90) should work. Mobile Safari has additional quirks worth knowing about — see Troubleshooting → Mobile Safari.

HTTPS required for camera access in production. localhost is exempt during development.

Need help?

Troubleshooting: common issues and solutions
API Reference: complete API surface
support@incode.com: direct support