On this page
Use the URL returned by the API
After creating a transaction, use a hosted journey link returned in the response, such as links.webview_url. Do not invent a URL by concatenating transaction_id, an identity number or a customer identifier. Documentation URLs are synthetic and do not identify a real person.
The person completes verification in a compatible browser. Your application does not need to receive or store the API key to open this workflow. The key remains on the server that created the transaction.
Treat the link as sensitive access
Share it only with the person and through channels allowed by your process. Do not put the complete URL in public analytics tools, uncontrolled logs or open support messages. Protect short links too: they remain a way to access the journey.
Required steps depend on the configuration that applies to the transaction. Do not replace a required step with a local screen, and do not mark the journey complete because the person closed the browser.
Track results rather than guessing
Opening a link is not approval. Read the transaction through your backend and process authenticated events. An interruption can leave the flow pending; expiration requires a decision in your process without borrowing results from another transaction.
See results and status to decide how to proceed and webhooks to receive updates independently of the person’s screen.