---
title: "KYC Hosted Sessions"
description: "How long a hosted KYC verification link stays open, and what your backend sees once it expires."
canonical_url: "https://noxtica.com/docs/kyc-hosted-sessions/"
markdown_url: "https://noxtica.com/docs/kyc-hosted-sessions/index.md"
last_updated: 2026-10-27
published: 2026-09-27
section: "identity-verification"
section_title: "Identity Verification"
site: "Noxtica"
language: "en"
source: markdown
---

# KYC Hosted Sessions

A hosted KYC session is a one-shot verification link your backend mints server-side and hands to your end customer (redirect, email, or QR). The customer completes identity verification on Noxtica's hosted page; your backend never receives the session's bearer token or the customer's raw answers directly.

## Session lifetime

An unopened link keeps its normal default validity. Once the customer opens it, the capture window narrows to **30 minutes from that first open** — not from when your backend minted the link. Both the customer-facing session view and your backend's own session status read carry `openedAt` (when the customer first opened the link, or absent if they have not yet) and `expiresAt` (the session's current effective expiry), so either side can tell which state a session is in without guessing.

## After expiry

Once a session's capture window lapses, its 5 customer-facing routes — session view, progress, submit, evidence upload, and evidence finalize — each return an HTTP `410 Gone` with:

```json
{ "error": "session_expired", "code": "kyc_session_expired", "requestId": "..." }
```

Your backend's own session status read (`GET /v1/kyc/sessions/{sessionId}`) is **not** one of these: it keeps returning `200` with `status: "expired"`, so a polling backend can observe the terminal state without special-casing an error response.

Treat a `410` from any customer-facing route as terminal: stop polling or retrying against that session, and mint a new one if the customer still needs to complete verification.

## Related reading

- [Identity verification integration](https://noxtica.com/docs/identity-verification-integration/) — create a session, send the customer to the link, and read the outcome by status read or signed event.
- [Backend Integration](https://noxtica.com/docs/backend-integration/) — keep the credential on your server and handle explicit response states.
- [Integration Flow](https://noxtica.com/docs/integration-flow/) — trace a full evaluation from collection to customer policy.