Introduction
VeriFlow is a self-hosted identity verification platform. Create verification sessions from your backend, send users to a fully-branded hosted flow, and receive signed webhooks with the decision.
How it works
- Create an API key in the admin console (Admin → API Keys).
- POST /api/v1/verifications from your backend with a
subject_ref (your user's ID).
- Redirect the user to the returned
hosted_flow_url — a page branded with your logo and colors.
- The user photographs their document and takes a live selfie.
- Your configured provider runs document, liveness, and face-match checks.
- You receive a signed webhook (
verification.approved / verification.declined / verification.review).
Key concepts
| Term | Meaning |
|---|
| Verification | One identity check for one subject, with an immutable event timeline. |
| Provider | The verification engine (e.g. Didit, iDenfy). Bring your own account — your end users never see the provider. |
| Hosted flow | The branded verification page served at /v/{token}. |
| Review queue | Borderline cases routed to your analysts for a manual decision. |
| Retention | Automatic purging of captured images and PII after configured windows. |
Statuses
| Status | Meaning |
|---|
pending | Created, user hasn't started. |
in_progress | User is completing the flow. |
review | Provider flagged it; awaiting your analyst. |
approved | Identity verified. |
declined | Checks failed or analyst declined. |
expired | TTL elapsed without completion. |
cancelled | Cancelled via API. |
Next: Installation →