Hosted Verify Page: Zero-Code Liveness Integration

The hosted page at https://app.spoofsense.ai/verify runs the same capture flow as the Web SDK, served from SpoofSense’s origin. Create the session on your backend, then redirect the user to the page or embed it in an iframe — no frontend SDK to install or maintain.

The client token always travels in the URL fragment (#token=…), never a query parameter. Fragments don’t reach servers, so the token never lands in access logs.

Redirect Mode

After creating the session on your backend, build the hosted URL and send the user there:

const verifyUrl =
  "https://app.spoofsense.ai/verify" +
  `#token=${session.client_token}` +
  `&return_url=${encodeURIComponent("https://yourapp.com/kyc/continue")}`;
res.redirect(verifyUrl);

When the user finishes, SpoofSense redirects them back to your return_url with the following query parameters:

?spoofsense_status=complete&spoofsense_session_id=vs_…

spoofsense_status can also be cancelled or error. The query string is a hint, not proof — always read the authoritative decision server-side using your secret key.

Embed (iframe) Mode

Embed the capture flow directly in your page using an iframe. The allow="camera" attribute is required, or the browser blocks capture inside the frame:

<!-- allow="camera" is required, or the browser blocks capture inside the frame -->
<iframe
  id="spoofsense-verify"
  allow="camera"
  style="width: 100%; max-width: 420px; aspect-ratio: 3 / 4; border: 0"
></iframe>

<script>
  // clientToken comes from YOUR backend. Never mint it in the browser.
  document.getElementById("spoofsense-verify").src =
    "https://app.spoofsense.ai/verify" +
    "#token=" + clientToken +
    "&origin=" + encodeURIComponent(location.origin);

  window.addEventListener("message", (e) => {
    if (e.origin !== "https://app.spoofsense.ai") return; // only trust the hosted page
    if (e.data && e.data.type === "spoofsense:complete") {
      notifyBackend(e.data.verificationSessionId); // backend reads the decision
      // e.data.capturedFrame is the submitted JPEG (Blob), for a local preview.
      preview.src = URL.createObjectURL(e.data.capturedFrame);
    }
    // also emitted: { type: "spoofsense:cancel" } and
    //               { type: "spoofsense:error", code, message }
  });
</script>

Always verify e.origin before trusting a message. Treat completion as a hint: the decision only counts when your backend reads status: "complete" and decision: "real" with the secret key.

PostMessage Events

The hosted page posts these events to your parent window in iframe mode:

Message type	Payload
`spoofsense:complete`	`verificationSessionId`, `capturedFrame` (Blob), `capturedFrameSha256`, `width`, `height`
`spoofsense:cancel`	—
`spoofsense:error`	`code`, `message` (standard error codes)

capturedFrame rides the message only because &origin= named your page as the target. In redirect mode the image isn’t carried in the redirect — your backend retrieves it from the media endpoint instead.

Get Started

Guides

Verification Sessions

Hosted Verify Page: Zero-Code Liveness Integration

Redirect Mode

Embed (iframe) Mode

PostMessage Events

​Redirect Mode

​Embed (iframe) Mode

​PostMessage Events

Redirect Mode

Embed (iframe) Mode

PostMessage Events