IDENTITY VERIFICATION
Hosted identity verification, with the decision left to you
Send customers to a hosted verification flow. Read the case status in your own backend and route exceptions to human review.
A governed workflow, not an automatic verdict
Identity verification returns a case status and a review path. It supports your decision. It does not make it.
Session path
Session created
A single-use link and an expiry.
Link opened
The customer reads a privacy notice. The window to complete is time-limited.
Case status
Status read or event
Finished, unverified or needs review. Treat each status as input to your own decision.
Fallbacks to plan for
Expired
Emits no event. Read the status to observe it.
Cancelled
Read the status from your backend.
Ends in an error
Sessions can end in an error. Plan a fallback.
Hosted verification link
Case status for your decision
Human review path
Event notifications
From session to case status
Server
Create a session
Uses your own reference for the subject. You receive a single-use link and an expiry.
Noxtica
Customer works on the hosted page
Single-use link
The customer reads a privacy notice, then supplies the requested evidence in a time-limited window.
Server
Status read or event
Case status
Read the status from your backend, or receive an event on your endpoint.
Console
Human review
Exceptions
Cases that need a second look go to operator review. Review activity is recorded in an audit trail.
Your team
Your decision
Your team makes the decision.
Create a session
The customer works on the hosted page
Read the status and decide
What it is, and who it is for
Noxtica identity verification (KYC) is a hosted flow. Your server creates a session, your customer completes the steps on a page hosted by Noxtica in their own browser, and your server reads the outcome by a status read or a signed event. Your server never receives the customer's answers or capture directly.
Results are automated signals. You decide what each outcome means for your customer. Noxtica hands you the evidence and an audit trail.
Who it is for
- Backend engineers who create sessions and read outcomes.
- Operations and compliance teams who set up the hosted page and work the review queue in Backoffice.
- Teams whose policy requires identity evidence and who have a person who owns the review.
Business and merchant verification
The same hosted approach covers businesses and merchants. KYB (know your business) is hosted business onboarding: the business representative enters business information, uploads documents, declares owners, reviews and submits, and the submitted case goes to human review in Backoffice, where operators see the ownership graph, documents and screening. KYM (know your merchant) is hosted merchant onboarding plus notify-only transaction monitoring: an alert is a notification for a person to review and never starts a payment action. No automated business-registry check is described. Results are signals and your operators decide. Available. Enabled for your account on request.
Availability
Controlled availability. Identity verification is provisioned per tenant by your account team, and you cannot switch it on yourself. Steps described as optional apply only when they are enabled for your organisation.
The hosted flow, end to end
This is what happens from the first API call to the result. Steps marked optional apply only when they are enabled for your organisation.
Your server creates a session
A server call creates a session with your own opaque customer reference. The response carries a session id and a single-use link.
The customer gets the link
Send the customer to the link as a redirect, a new tab, an email or message, or a QR code. The hosted page also offers a QR code and a copy-link option, so a customer who starts on a computer can continue on a phone.
Privacy notice and consent
Before anything is captured, the customer sees your business name, the purpose of the verification and a link to your privacy notice, and agrees to continue.
Choose a document, capture front and back
The customer chooses one of the document types you accept, then captures the front. The back is required for identity cards, driving licences and residence permits. A passport has no back step.
Selfie
The customer takes a selfie. It is compared with the portrait on the document and checked for quality.
Liveness
The customer completes a short liveness challenge on camera: head turns and a blink.
Review
A finished capture waits in the review queue in your Backoffice until someone in your organisation records a decision. The session reads review pending and does not expire while it waits.
Result: status read and signed events
Your server reads the session status and can subscribe to signed webhook events. Read the status before you act on an event: the status is the authority.
Link lifetime
An unopened link stays valid until its own expiry, one day by default. After the customer first opens the link, the customer has 30 minutes to finish, or until the original expiry if that comes sooner.
What the hosted page does not do
- It cannot be embedded in an iframe. Open it as a full page or in a new tab.
- It follows the customer's browser language. You cannot set it.
- Some in-app browsers cannot run it. The page tells the customer how to continue in a regular browser.
Supported documents and what is read
You choose which documents your customers may use, and with which issuing countries, in the hosted page settings in Backoffice. The customer chooses among those. The hosted flow knows four document types:
| Document type | Back side captured |
|---|---|
| National identity card | Yes |
| Driving licence | Yes |
| Residence permit | Yes |
| Passport | No |
The printed text is read from the document. A machine-readable zone, where the document has one, is read and its check digits are verified, and the result is cross-checked with the printed text. A driving licence has no machine-readable zone, and its absence is not counted against it.
Turkish national identity cards and driving licences are handled explicitly: the Turkish personal number (T.C. Kimlik No) is read, and by default it is a required field for those two documents. A number that passes its check digits does not need the document number as well.
A zone that cannot be found or compared with the printed text is a measurement gap. It reads review, never fail. Noxtica publishes no country list beyond what you configure, and it makes no claim that every document of every country reads equally well.
Checks and signals
The hosted flow produces check results for a reviewer. They are signals that feed review. They do not decide an outcome and they are not guaranteed fraud blocking.
| Check | What it looks at |
|---|---|
| Document authenticity | Layout, machine-readable-zone structure, print consistency, signs of editing or copied regions, hologram presence, signs of a screen recapture and card geometry. Each check reports its own result. |
| Face match | Compares the portrait on the document with the selfie. A low score is evidence for the reviewer. |
| Selfie quality | Sharpness, exposure, and face size and pose in the selfie. |
| Liveness | A challenge of head turns and a blink. The gesture checks show that the requested movement happened. They are not a presentation-attack test. |
| Presentation-attack detection (PAD) | Looks at frames of the liveness challenge and at the selfie and produces a score. The result is advisory. |
Outcomes and review
| Status | Meaning |
|---|---|
pending | Created. The customer has not opened the link. |
opened | The customer opened the link and is working through the steps. |
verifying | The customer submitted and processing is running. |
review_pending | Processing finished and a decision is needed in your Backoffice review queue. Not a rejection, and not an approval. |
completed | A decision approved the session. |
unverified | Processing finished with a negative outcome. |
error | Processing could not finish, because of a fault or a refusal. |
expired | The link or the capture window lapsed before a decision. |
cancelled_by_user | The customer cancelled on the hosted page. Applies when cancelling is enabled for your organisation. |
A qualified person on your team should review adverse decisions before they affect a customer. Results are probabilistic and can include false positives and false negatives. They are not legal proof of identity.
For developers
Everything below is plain HTTPS from your server. The full reference is in the documentation.
Three ways to start a verification
- Hosted session from your server. Your server creates the link by API and Noxtica hosts the page.
- Invitation from Backoffice. A person in your organisation creates the link in Backoffice, with no code.
- Direct API from your server. Server-to-server routes without a hosted link. It gives your own screens no way to capture a document for checking today, so use a hosted session when the customer must capture a document.
Create a session
Authenticate with a server key that has the identity permission. Keep the key on your server. Send an Idempotency-Key so a retry does not create a second session.
curl -sS https://collect.noxtica.com/v1/kyc/sessions \
-H "Authorization: Bearer $NOXTICA_SERVER_KEY" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: $(uuidgen)" \
-d '{"subjectRef":"cust_example","returnUrl":"https://merchant.example.com/verification/return"}'The response
The link is returned once, in this response. Treat it as a secret and do not log it. The expiry is in epoch milliseconds.
{
"ok": true,
"sessionId": "00000000-0000-4000-8000-000000000001",
"url": "https://verify.noxtica.com/s/EXAMPLE_TOKEN",
"expiresAt": 1790848845000,
"domainId": null,
"requestId": "req_example"
}Read the status
A session you created always returns 200, including an expired one. Poll with a growing delay and stop at a final status.
GET https://collect.noxtica.com/v1/kyc/sessions/00000000-0000-4000-8000-000000000001
Authorization: Bearer $NOXTICA_SERVER_KEYWebhook events
Events are signed HTTPS deliveries to an endpoint you register in Backoffice. An event is a notification, not a decision.
| Event | Fires when |
|---|---|
kyc.session.completed | A hosted session reaches completed, unverified or error. A session in review pending fires it later, when a reviewer decides. |
kyc.session.cancelled | The customer cancels on the hosted page. Subscribe explicitly. When enabled for your organisation. |
kyc.verification.completed | A verification reaches a final state. |
kyc.erasure.completed | An erasure request completes. When erasure is enabled for your organisation. |
kyc.document.expiry_warning | A verified document is close to expiry or has expired. When enabled for your organisation. |
kyc.reverification.due | A scheduled re-verification becomes due. When enabled for your organisation. |
Sample event
Synthetic values only. Events never carry your customer reference: match an event to your customer by the session id.
{
"id": "00000000-0000-4000-8000-000000000001:endpoint_example",
"type": "kyc.session.completed",
"created_at": 1790762445000,
"tenant_id": "tenant_example",
"data": {
"schemaVersion": "1",
"sessionId": "00000000-0000-4000-8000-000000000001",
"status": "completed",
"verificationId": "verification_example",
"reasonCodes": ["provider_manual_review"],
"occurredAt": 1790762445000,
"deliveryId": "00000000-0000-4000-8000-000000000001:endpoint_example"
}
}Verify every delivery
- Each delivery carries the headers X-Noxtica-Signature, X-Noxtica-Timestamp, X-Noxtica-Event and X-Noxtica-Delivery.
- The signature is an HMAC-SHA256 over the timestamp, a dot and the raw request body. Verify it before you parse the body, and enforce your own timestamp tolerance.
- Delivery is at least once and order is not fixed. Deduplicate on X-Noxtica-Delivery, then read the session status before you act.
No SDK is required. The documentation shows examples in curl, Node.js and Python.
Read more in the documentation
Data protection
This section describes what the documentation states. It is not legal advice, and the Privacy Policy and the Security page describe how Noxtica handles personal data.
Retention
Noxtica does not delete verification details or evidence automatically, and it sets no retention date for them. They stay in your tenant until a tenant administrator deletes them.
Deletion
A tenant administrator deletes verifications in Backoffice with a reason, a typed confirmation and a fresh step-up check. A delete removes the verification, its evidence files and records, and keeps billing usage records, legal-basis receipts and the audit trail. It cannot be undone.
Data-subject rights
Right-to-erasure requests are worked on the KYC Erasure page. A second administrator approves a request, a legal hold can pause it, and each stored item has a deletion receipt. Ask your account team what an approved request covers for your tenant before you promise a customer a timeline.
Evidence access
Opening the original captures is a separate, higher permission than reviewing a case. It is limited to administrators, asks for a fresh step-up check, and every view is audited. Other roles see findings and measurements, not the originals.
Encryption and isolation
Raw identity evidence is stored encrypted at rest, and only when raw evidence storage is armed for your tenant. A session that belongs to another organisation reads as not found.
Residency
Evidence storage carries a per-tenant residency setting of TR, EU or US. Ask your account team what it covers for your tenant. This page makes no statement that data stays in a particular country.
Consent and legal basis
The hosted page shows the customer your purpose and privacy notice before capture. An authorised person in your organisation records the legal basis, and Noxtica does not choose one for you. You own the notices, consents and legal basis in each jurisdiction you serve.
Common questions
Can I switch identity verification on myself?
No. It is provisioned per tenant under controlled availability. Contact the team to discuss your use case and jurisdiction.
Does it approve customers automatically?
No. No check result makes a hosted verification verified by itself. Every hosted verification waits for a person to record a decision, and only completed is an approval.
Does presentation-attack detection block fraud?
No. PAD is advisory. Noxtica reports its result and never lets it decide. Treat it, like every check, as a signal for a reviewer.
Is a result legal proof of identity?
No. No result is legal identity proof outside the scope of the configured provider and contract. Noxtica is not a consumer reporting agency, and output must not be used for credit, insurance, employment or housing eligibility.
How long is a verification link valid?
One day by default, and you can set it when you create the session. After the customer opens it, the customer has 30 minutes to finish.
Can I embed the hosted page or set its language?
No. The page refuses to load in an iframe, and its language follows the customer's browser.
Which events can I receive?
Six identity events: kyc.session.completed, kyc.session.cancelled, kyc.verification.completed, kyc.erasure.completed, kyc.document.expiry_warning and kyc.reverification.due. Some depend on settings for your organisation.
How long do you keep the evidence?
Noxtica sets no retention date and does not delete verification details or evidence automatically. A tenant administrator deletes them.
Are business and merchant verification available?
Yes. Business verification (KYB) and merchant verification (KYM) are available. Your server creates a link, the business or merchant completes onboarding on a Noxtica-hosted page, and your operators review the case in Backoffice. Enabled for your account on request.
Related pages
What identity verification does not do
- Controlled availability. Identity verification is provisioned per tenant.
- Not legal identity proof. No result is legal identity proof outside the scope of the configured provider and contract. Results are probabilistic and can include false positives and false negatives.
- You decide. A qualified person on your team should review adverse decisions. Noxtica is not a consumer reporting agency. Do not use output for credit, insurance, employment, or housing eligibility.
- Your responsibilities. You own the notices, consents, and legal basis for collecting identity evidence from your customers in each jurisdiction you serve.
Scores, reasons and verdicts are probabilistic estimates, not statements of fact. Your team makes every decision.Read the disclaimer