## Use the URL returned by the API

After creating a transaction, use a hosted journey link returned in the response, such as `links.webview_url`. Do not invent a URL by concatenating `transaction_id`, an identity number or a customer identifier. Documentation URLs are synthetic and do not identify a real person.

The person completes verification in a compatible browser. Your application does not need to receive or store the API key to open this workflow. The key remains on the server that created the transaction.

## Treat the link as sensitive access

Share it only with the person and through channels allowed by your process. Do not put the complete URL in public analytics tools, uncontrolled logs or open support messages. Protect short links too: they remain a way to access the journey.

Required steps depend on the configuration that applies to the transaction. Do not replace a required step with a local screen, and do not mark the journey complete because the person closed the browser.

## Track results rather than guessing

Opening a link is not approval. Read the transaction through your backend and process authenticated events. An interruption can leave the flow pending; expiration requires a decision in your process without borrowing results from another transaction.

See [results and status](/en/developers/kyc/results-and-status) to decide how to proceed and [webhooks](/en/developers/kyc/webhooks-and-events) to receive updates independently of the person’s screen.