Skip to main content
VerifyYou confirms that the person on the other end of your app is a real, live, unique human, not a bot, a deepfake, or someone who already came through. You send them through a hosted verification flow; they come back with a result you confirm on your server.

​
The whole flow in one picture

1

Start a verification

From the browser with the SDK’s vycheck(), or from your server with POST /v3/initialize. The flow can run as a full-page redirect, a drawer that slides over your page, or an inline embed. Pick the presentation in init().
2

We verify the human

The hosted flow runs a short face check for liveness, then a uniqueness check against people who already verified. It works in place on phones and desktops alike, and a desktop user can move the session to their phone with a QR code and be returned automatically. See Humanness and uniqueness.
3

The result comes back to your app

Redirect mode returns the user to your page with ?vyt=<token>&vyc=<0|1> on the URL. The embedded modes hand the same result to your onComplete callback with no redirect. Either way, read it with vyget().
4

Confirm on your backend

Exchange the token for the authoritative result with GET /v3/confirmations/{token}. Gate access on that, never on the URL alone.

​
Where to go next

init(): setup and display modes

One-time SDK setup, and choosing redirect, drawer, or inline.

Humanness and uniqueness

How we prove someone is live, then prove they’re unique.

vycheck() and vyget()

The two browser calls that drive the whole flow.

POST /v3/initialize

Mint a session server-side, with a full parameter breakdown.

​
Keys

You get two keys, in test and live flavors:
  • Publishable key (pk_test_… / pk_live_…) is safe to ship in the browser. Used by the SDK.
  • Secret key (sk_test_… / sk_live_…) is backend only. Used to confirm tokens and to initialize server-side.
The pairs are matched: a flow started with a test publishable key mints tokens only the test secret key can confirm, and the same goes for live. Build with the test pair, then swap both keys when you ship.
Never put a secret key in client-side code. Confirm verification results on your server with the secret key. The vyc value the client sees is only a UI hint.