Sign in

Signing in is how claims about a person reach your application. It is the only way they reach your application.

Start with the choice of integration. The four pages after it are the flow itself; then documents, revocation, private sign-in, the drop-in component, and the parts that bite later: refusals, the full webhook contract, the profile picture, and the mobile SDKs.

Pages in this section

• Choosing your integration

  Hosted redirect or drop-in button — and why the third way is not a way to sign people in.

• How the flow works

  authorize → consent → code → token → userinfo, and what each step is actually responsible for.

• Choosing claims

  Twenty-one scopes, three risk tiers, and the difference between a ceiling and a grant.

• What the person sees

  The concrete release, who you are, until revoked, and a passkey.

• Handling the callback

  state, nonce, PKCE — and the one rule that catches everybody: absent is not false.

• Identity documents

  A document policy, each document named on the screen, and a proof block.

• Revocation and webhooks

  The person disconnects the whole thing, and you hear about it — if you asked to.

• Private sign-inNot yet available

  An application that receives a `sub` and `identity_verified` and nothing else, and keeps one `sub` per person, even after they delete their UnifyID account and come back with the same document.

• The drop-in component

  A launcher, an SRI-pinned script, and two backend routes you still have to write.

• Profile photo comparison

  Compare an uploaded photo with the connected person’s enrolled reference, with their permission.

• Errors and refusals

  Where each kind of refusal arrives, the one envelope every API error uses, and the step-up that is not a denial.

• Webhooks

  19 events, one envelope, a five-step retry schedule, and the endpoint routes — generated from the API's own catalogue.

• Profile picture

  A restricted scope, a `picture` claim that is a link rather than bytes, and an endpoint that answers only while the consent does.

• Mobile SDKs

  Native helpers for Android, iOS, Flutter and React Native. The system browser, PKCE, verified HTTPS callbacks, and no client secret in the app.