Connect Solidus Verify to your existing stack

The useful framing is that there are only three ways in, and which one you want depends on a single question: who talks to the user?

1 · The hosted flow: we do

You create a session and redirect the user to it. Solidus renders the capture steps, handles document photography, the liveness check, chip reading where available, and the consent language. You get a result back.

Choose this when you do not want to build camera handling, document-quality feedback, or consent copy, which is most teams, because those are where verification flows actually fail.

Note that the hosted flow is noindex and session-gated, and its copy carries the data-handling language a compliance reviewer will read before approving you. Ask to see that copy during evaluation rather than after.

2 · The SDK: you do

npm i @solidus-network/sdk

Published under @solidus-network on npm alongside auth, bbs and types. Recount the exact version before quoting it anywhere: the package line has drifted before and a stale version number in your docs is a support ticket waiting to happen.

Choose this when the verification has to feel like part of your product, or when your flow is unusual enough that a hosted screen cannot express it.

3 · Webhooks and API keys, the operational seam

Whichever of the two you pick, results arrive asynchronously and your systems need to react. Authenticate with an API key; receive outcomes on a webhook.

The one design note worth stating: treat a webhook as a notification, not a source of truth. Fetch the authoritative result over the API when one arrives. This is standard practice and it is also what keeps a replayed or spoofed delivery from mattering.

What arrives at the end

Not a raw document scan. A W3C Verifiable Credential the user holds and can re-present, which is the entire reason to choose this over an ordinary IDV vendor.

What integrating does not do for you

It does not discharge your own regulatory obligation. If your regulator requires you to perform customer due diligence, accepting a credential, ours or anyone's, does not transfer that duty to us. Reuse is a cost and user-experience argument. Anyone selling it to you as compliance transfer is overselling it, and we would rather you heard that from us during evaluation than from your compliance team afterwards.

Solidus holds no certification: not SOC 2, not ISO 27001, not eIDAS qualified status, all 2027 roadmap items. AML, KYB and sanctions screening are not shipped; do not plan around them.

What to check before you commit

1. The document types you actually need, confirm against the live list rather than assuming; see supported documents.
2. The hosted flow's consent copy, in the language your users read.
3. Data handling: document images are retained on a 30-day window and call/voice recordings for up to a year, because identity-verification records must be kept. Deletion runs automatically.
4. That "unaudited" is acceptable to your risk function. If it is not, that is a legitimate answer and you should wait for the audit.