Dark
Log inRequest a walkthrough
On this page
Developer overview

KYC Hosted Sessions

A hosted KYC session is a one-shot verification link your backend mints server-side and hands to your end customer (redirect, email, or QR). The customer completes identity verification on Noxtica’s hosted page; your backend never receives the session’s bearer token or the customer’s raw answers directly.

Session lifetime

An unopened link keeps its normal default validity. Once the customer opens it, the capture window narrows to 15 minutes from that first open — not from when your backend minted the link. Both the customer-facing session view and your backend’s own session status read carry openedAt (when the customer first opened the link, or absent if they have not yet) and expiresAt (the session’s current effective expiry), so either side can tell which state a session is in without guessing.

After expiry

Once a session’s capture window lapses, its 5 customer-facing routes — session view, progress, submit, evidence upload, and evidence finalize — each return an HTTP 410 Gone with:

{ "error": "session_expired", "code": "kyc_session_expired", "requestId": "..." }

Your backend’s own session status read (GET /v1/kyc/sessions/{sessionId}) is not one of these: it keeps returning 200 with status: "expired", so a polling backend can observe the terminal state without special-casing an error response.

Treat a 410 from any customer-facing route as terminal: stop polling or retrying against that session, and mint a new one if the customer still needs to complete verification.

  • Backend Integration — keep the credential on your server and handle explicit response states.
  • Integration Flow — trace a full evaluation from collection to customer policy.