Soliton Identity Verification — demo

01Choose the hand-off

Same backend, same one-time link. Only how the user reaches the camera step differs.

A fixture completes to a fixed outcome without ever requesting camera or microphone, so you can exercise the whole integration — including the awkward partial branch — with no consenting participant. Fixtures do not exercise liveness or anti-deepfake logic; real sandbox captures do.

02Verdict

Fetched server-to-server against the id this server stored at creation time — never the id the browser reported.

No verification yet

Start one above.

03Completion webhooks

Signed verification.completed deliveries received at /webhooks/soliton.

The webhook is a signal, not the verdict. This server verifies the X-Soliton-Signature HMAC over the raw bytes, rejects anything outside a 5-minute window, de-duplicates on X-Soliton-Event-Id, and answers 2xx before doing any work — deliveries are at-least-once and unordered.

04Before this works against your account

Two allowlists, registered by Soliton per environment. They are separate — one does not imply the other.

Redirect domains. Required for the redirect hand-off. Without registration, redirect_url is rejected with a 400. Registering a domain covers its subdomains.

Iframe origins. Required for the Web SDK. Send the exact origin (scheme + host + port) of the page that directly contains the Soliton iframe — here, this page. Wildcards are not accepted, and a new origin can require a Soliton deployment. An unregistered parent gets origin_not_allowed.

Response headers, merged into your existing policy — not replacing it:
Content-Security-Policy: frame-src https://soliton.id; script-src https://soliton.id
Permissions-Policy: camera=(self "https://soliton.id"), microphone=(self "https://soliton.id")
script-src is only needed because this page loads the hosted SDK build; drop it if you bundle the npm package. Do not add Soliton to your own frame-ancestors — that directive controls who may frame you.