Step 1
Start and language
The user presses a button on your site or opens a link. On a computer with no camera the widget shows a QR code to continue on a phone. The interface language can be changed right away.
User verification on a website and in an app
KYC on a website and in an app with no capture interface of your own: the NeuroVision widget walks the user through the steps — document, selfie, checks — and sends the result to your server. Add it with a script or an npm package, send the customer a unique link, or build your own interface on the API. In a mobile app the widget runs through a WebView.
Data is stored in Russia Russian software registry no. 19972 The widget and customisation — in every plan
KYC on a website and in an app: what you embed in your product
Online identity verification on a website is not a single button but a ready-made part of the product: capture screens, image checks, anti-fraud and delivery of the result to your server. You get all of it in full and configure it without a release.
- What it looks like
Ready-made capture screens
The instructions, the document frame, error hints and the completion screen are already built and work on a computer and a smartphone. You do not need to develop a camera interface.
- KYC and AML: instructions
A scenario with no release
Steps, document types, countries and checks are set in the scenario editor in the personal account. Change the scenario — and the widget on your site works the new way at once.
- Anti-fraud
Checks built in
Recognition of 16,000+ document types from 195+ countries and territories, anti-fraud image checks: signs of editing, a photo of a screen, a printout. Selfie and liveness check — if enabled in the scenario.
- Events and the webhook
The result goes to your server
The result arrives by webhook at your backend address and is available on a status request. The browser receives only a completion event.
- Customisation
Your brand and language
The logo, colours, screen texts and interface languages are set in the editor and are included in every plan.
- WebView and the app
Website, browser, app
The same widget works on a website, in a mobile browser and in an app — through a WebView or an in-app browser. There are no native SDKs for iOS and Android.
A widget, a unique link or your own interface via the API
The three ways to embed the check lead to the same result — a KYC session with the same JSON and the same webhook. The difference is how much code you write and who draws the capture screens. The ways can be combined: a widget on the site, a link in an email.
- Verification by link
Unique link
A check with no integration: the customer opens a link and completes the steps on a NeuroVision page
How it is connected
- link
kyc.neuro-vision.ru/<scenario ID>/<encrypted clientKey>is built on your server; one-time KYC links are created in the personal account — from 1 to 1,000 at a time, with an expiry
What your team does
- sends the link by email, SMS or messenger and receives the webhook; no code is needed on the site
When to choose it
- a one-day pilot, a repeat check of a customer, checking employees and couriers, B2B services with no app of their own
Limitations
- the customer leaves your service's page; the design is the same as the widget's
- link
- Embedding the widget
KYC widget (Web SDK)
Ready-made capture screens inside your site or app
How it is connected
- script
widget-lib.jsor the npm packagekyc-widget-nvfor React; over the page or inside a block (mountElementId); in an app — a WebView or an in-app browser
What your team does
- encrypts
clientKeyon the server, calls the widget on a button click, receives the webhook
When to choose it
- sign-up and application on a site, a personal account, a mobile app with no camera of its own
Limitations
- cannot be placed in someone else's (cross-origin) iframe — the browser will block the camera; some of the hints during capture cannot be changed
- script
- REST API
Your own interface via the API
Your app draws the capture, your backend sends the images
How it is connected
- the backend sends the images to
POST /kyc/processand reads the response or the webhook
What your team does
- draws the screens and the camera, checks the frame quality before sending, handles step errors and retakes
When to choose it
- capture is already built into a native app, you need full control of the interface, the documents come from your system
Limitations
- more development; how to run a liveness check without the widget is clarified during test access
- the backend sends the images to
How a user completes the check in the widget
A typical «passport and a selfie with the document» scenario on a phone. Steps are switched on and off in the scenario, and the screen texts can be rewritten for your product. How the liveness check works — on the page Liveness. You can see the check through the user's eyes in the demo.
Step 2
A short briefing
The widget explains what happens next and asks the user to get the document ready and find good light. This is also where the links to your terms and privacy policy appear.
Step 3
Camera access
The browser asks for permission to use the camera. Without it capture is unavailable, so before the request the widget explains why the camera is needed.
Step 4
Capturing the document in the frame
The whole document must fit in the frame: no fingers over the margins, no glare or blur. For weaker devices the frame can be made vertical or horizontal.
Step 5
Checking the image
If the image is suitable, the widget confirms receipt. If not — it shows what to fix, for example «margins not visible», and offers a retake.
Step 6
A selfie with the document
The user holds the document next to their face so that both fit in the frame. If the scenario has a liveness check, it runs at this stage.
Step 7
Completion
The widget says the check is complete and closes. Your frontend receives an event, and the result with the data goes to your server.
A verification widget for a website: a script, an npm package or a link
The verification Web SDK is added in a few lines. Two values are needed: the scenario identifier from the personal account and the key encrypted on your server, clientKey.
What you will need
- A scenario and its ID — in the «KYC/AML» section of the personal account
- The scenario's secret key — on your server only
- A site served over HTTPS
- A backend address for the webhook
- A 1-month trial period
Adding the widget to a page
HTML<button id="verify-btn" disabled>Loading…</button>
<script>
const btn = document.getElementById("verify-btn");
const script = document.createElement("script");
script.src = "https://kyc.neuro-vision.ru/lib/widget-lib.js";
script.onload = () => {
btn.disabled = false;
btn.textContent = "Start verification";
};
document.body.appendChild(script);
btn.addEventListener("click", () => {
window.KYCWidget.setupKYC({
scenarioId: "b7e4c1d2-0a9f-4e3b-8c5d-6f1a2e3b4c5d", // scenario ID (example)
clientKey: "q8Zt3kVf2mN9wX1yR4pL0sA7bC6dE5gHjK2lM3nP4rS=", // encrypted on the server
clientUser: "user-000123",
theme: "light",
stickySession: true,
successCb: (sessionJson) => {
const { sessionId, status } = JSON.parse(sessionJson);
console.log("Session completed:", sessionId, status);
// the decision is made by the backend — from the webhook or a status request
},
finalizedCb: ({ status }) => console.log("Already completed:", status),
closeCb: () => console.log("Widget closed"),
});
});
</script>A unique verification link
URLhttps://kyc.neuro-vision.ru/<scenario ID>/<encrypted clientKey>
https://kyc.neuro-vision.ru/<scenario ID>/<encrypted clientKey>/<clientUser>
Example (made-up values):
https://kyc.neuro-vision.ru/b7e4c1d2-0a9f-4e3b-8c5d-6f1a2e3b4c5d/q8Zt3kVf2mN9wX1yR4pL0sA7bC6dE5gHjK2lM3nP4rS%3D/user-000123The encrypted key is a Base64 string: in a link it must be URL-encoded (= → %3D, / → %2F, + → %2B). How to encrypt clientKey on the server, all the widget parameters and a React example — in the documentation: integration, parameters, working with clientKey.
Identity verification in an app: WebView, in-app browser and camera
There are no native SDKs for iOS and Android — and for verifying a user in a mobile app they are not required. The widget is responsive and works with the smartphone camera, so KYC for a mobile app is added through a WebView or an in-app browser. Below is what to set up so the camera opens.
- Permission
CAMERA -
WebChromeClient.onPermissionRequest - JavaScript and DOM Storage
- Page address
-
NSCameraUsageDescription -
allowsInlineMediaPlayback - The camera access decision
- SFSafariViewController (iOS)
- Chrome Custom Tabs (Android)
- A link or your page
- Returning to the app
- Someone else's (cross-origin) iframe
-
setupKYCinsidecloseCb - The decision from
successCb - One WebView for several customers
- WebView settings are not described in the NeuroVision documentation: they are general Android and iOS requirements for a page's access to the camera. Check them in your app during test access. An in-app browser is the simplest route: it handles the camera permissions itself.
Widget events and the webhook: how the result reaches your system
-
On the frontend: callbacks
successCb— called only on a successful result; a JSON string arrives with thesessionId, the status and the steps.closeCb— the user closed the widget or the browser blocked the camera.finalizedCb— the widget was opened for a session that is already complete: its status arrives.Use the callbacks to close the window and show «We are checking your data».
-
On the backend: the webhook
Address — the Backend Callback URL in the scenario settings.
Encryption — the POST body is encrypted with the secret key.
Without personal data — the flag leaves only statuses in the notification, and the backend fetches the data itself by
sessionId.Final result only — with no intermediate statuses. Database checks can be received as they become ready.
-
Session outcome
success— all steps and checks passed.failed— at least one step or check failed; the reason is in the step errors.suspicious— signs of fraud; do not send any more frames to such a session.idle— the user did not finish.expired— the session lifetime set in the scenario has run out.
Linking the check to your user is done by clientKey: you set it yourself (a user or application ID), and exactly this value comes back in the webhook and the status request. The webhook format, status methods and error codes — on the page API and SDK for verification.
Widget customisation: logo, colours, texts and languages
The design — in every plan
Users must understand that they are being verified in your service. The design is set in the scenario editor with a live preview — with no code and no release. Customisation is included in the price of a KYC session: it is not paid for separately.
- 01
Logo and theme
A light or dark theme and a separate logo for each — preferably SVG or PNG with a transparent background. The theme can be overridden at launch with the parameter
theme. Links to your terms and privacy policy appear on the start screen. - 02
Colours
Backgrounds, primary and secondary text, the accent colour, success and error colours, the loader, shadows, borders, the primary and secondary buttons. Check the contrast of text and buttons in every state — the benchmark is WCAG 2.1 AA.
- 03
Screen texts
The heading, the instruction points, consent to personal data processing, QR code captions, capture hints, the success, rejection, retry and exhausted-attempts screens. The hints during capture and the liveness check, server errors, and country and document names cannot be changed.
- 04
Languages
Interface languages are ticked off — for example Russian, English, Spanish, German, French, Portuguese. The widget gets a switcher, and the terms and policy are shown in the chosen language. Translate your own texts yourself.
- 2 logos: for the light and dark themes
- 6+ interface languages to choose from
- 0 lines of code to change the texts
Mobile UX: hints, frame, retakes and attempts
Most users complete the check from a phone, in a hurry and in poor light. The widget is built so that a bad image does not turn into an abandoned application. How to design the whole customer journey — from sign-up to the decision — is on the page «Digital customer onboarding».
-
From a computer to a phone
If the computer has no camera or capture from a PC is disabled, the widget shows a QR code and a link: the user continues on a smartphone. Capture on a computer can be enabled in the settings.
-
A hint before capture
Before the camera there is a short screen: take the document out of its cover, put it on a flat surface, hold the phone upright. You write the hint texts yourself.
-
A frame for the document
The document is captured in a frame. For weaker devices the frame can be made vertical or horizontal — it is easier to fit the document in the shot.
- Why documents get re-shot
A clear reason for rejection
If the fields cannot be read, the face is cropped or the shot does not show a document, the widget says what to fix rather than just «error». Only the step where the problem occurred is retaken.
- KYC errors
Up to 6 attempts per step
Each scenario step gets up to 6 free capture attempts. After the last failed attempt the session closes and the widget shows the exhausted-attempts screen.
- KYC funnel
Interrupted — came back
With a «sticky» session enabled, a user who closed the widget continues the same check within 15 minutes instead of starting over. A completed session is not reopened by the widget — it shows its result.
Requirements for the browser, camera and images
-
Browser and site
The widget works in modern browsers on a computer and a smartphone — iOS and Android. The page with the widget must open over HTTPS: without a secure connection the browser will not give access to the camera.
-
Camera
The camera is needed at the capture steps. For a selfie and a liveness check it is mandatory; a document can be uploaded as a file only if the scenario allows it and anti-fraud is not critical for you. We advise capturing with the camera in the widget — the risk of substitution is lower.
-
Images
JPEG and PNG are accepted. A document must be at least 200 pixels on its longer side, a face — from 30×30 pixels. No glare, heavy compression or cropped edges; HEIC, WEBP and PDF files are rejected — this matters for your own interface.
The list of recognised documents — in the documentation: 16,000+ types from 195+ countries and territories.
Embedding security: keys, sessions and links
Secrets — on the server only
Only ciphertext goes to the browser
The scenario's secret key and the API token are kept on the backend. Only the clientKeyencrypted with this key is passed to the widget (the documentation has an AES-256-CBC example). Without the key someone else's clientKey cannot be substituted.
Session lifetime
An old session cannot be continued
The lifetime is set in the scenario: after it new images are not accepted, the session gets the status expired, and the widget shows the expired-session screen. A new attempt creates a new session.
Links with an expiry
One-time and limited
KYC links from the personal account are one-time, and each has a lifetime and a status: opened, passed, failed. A link built on the server should also be sent only to the owner of the application.
Protection against brute force
A suspicious session is closed
If different documents or faces appear in one session, the session gets the status suspicious and is closed. The number of attempts per step is limited, so images cannot be guessed endlessly.
The result is not in the browser
The server makes the decision
successCb is handy for the interface, but an event in a browser is easy to fake. Approve on the webhook or on a status request from the server; the webhook can be encrypted and sent without personal data.
152‑FZ
servers in Russia · Russian software register No. 19972
Glossary: terms for embedding the check
Words you meet in the Web SDK documentation and in conversations with developers.
- Web SDK (KYC widget)
- A ready-made NeuroVision JavaScript component that shows the user the steps of the check and sends the images to the service. It is added with the script
widget-lib.jsor the npm packagekyc-widget-nv. - Web SDK
- Scenario
- A set of steps and check rules: documents, countries, anti-fraud, selfie, webhook. It is created in the personal account editor, and its ID is passed to the widget as
scenarioId. - Scenario
- clientKey
- Your identifier of a user or an application, up to 36 characters. It is passed to the widget encrypted and returned in the API and the webhook as it was.
- clientUser
- An optional user ID, not necessarily unique. It is used to find all of one person's attempts and to delete their data.
- Scenario secret key
- The key from the personal account used to encrypt the
clientKeyand the webhook body. It is kept on the server only. - Scenario secret key
- KYC link
- A link to complete the check on the page
kyc.neuro-vision.ru. It is built on the server or created in the personal account as a one-time link. - WebView
- A mobile app component that shows a web page inside the app. For the widget to get the camera, the app grants the page permission.
- WebView / WKWebView
- Cross-origin iframe
- An embedded frame from another domain. The browser does not give such a frame the camera, so the widget does not work in it.
- Callback
- A function on your page that the widget calls on an event: completion, closing, reopening of a completed session.
- Callback
- Webhook
- A notification the service sends to your server's address when a session changes status or completes.
- Webhook
- Sticky session
- A mode in which the widget remembers the session for 15 minutes and continues it when reopened.
- Sticky session
- Retake
- Recapturing only the steps that failed verification; their numbers arrive in the field
retake. - Retake
How much a check through the widget costs
The widget, the unique link and interface customisation are included in every plan — you pay for a KYC session, not for the integration. Document recognition with anti-fraud checks — from 16 ₽ per session, a document with a selfie or a liveness check — from 29 ₽. A session includes all the scenario steps and up to 6 free capture attempts per step. An extra document in the same session — 10 ₽.
Calculate the cost- 01
From 16 ₽ per session: a document and anti-fraud checks
- 02
From 29 ₽: a document with a selfie or a liveness check
- 03
The widget, link and customisation — in every plan
The project «Development of a multimodal system using artificial intelligence "Neuromed" for managing the diagnostic processes of a clinic on the basis of the "Neurovision" computer vision platform» is supported by the Innovation Promotion Foundation within the federal project «Domestic Solutions»
The Neurovision computer vision platform is registered with Rospatent (certificate No. 2023661508) and included in the Russian Software Registry (entry No. 19972 of 13.11.2023)
The right to use the Platform is granted under a licence agreement concluded by Neurovision with its customers
Read also
How to make a check fast for the user and resistant to fraud — in our blog.
392 21
KYC Document Verification
Why users retake documents: how to reduce the number of repeat attempts during a KYC check
369 27
KYC, AML and Digital Identification
The KYC Funnel: How to Increase Verification Completion and the Approval Rate Without Slowing Down the Decision
479 29
KYC, AML and Digital Identification
How Video Streams Are Spoofed in KYC: The Architecture of Attacks via Emulators, Virtual Cameras, and Video Stream Injection
343 13
KYC, AML and Digital Identification
Digital KYC and e-KYC: how real-time remote identity verification works
Frequently asked questions about verification on a website and in an app
Add the widget-lib.js script and call the widget on a button click, passing the scenario ID and the clientKey encrypted on the server. For React there is the kyc-widget-nv npm package. If you would rather not write code, send the customer a unique link to the check.
The widget collects and checks data: it recognises the document, checks the images for forgery and, if enabled in the scenario, compares the selfie with the photo in the document. Customer identification within the meaning of Federal Law No. 115‑FZ is your organisation's procedure, and you make the decision on it. NeuroVision provides a verification tool; it does not replace your procedure.
Open the widget in a WebView or in the app's in-app browser: the widget is responsive and works with the smartphone camera. In a WebView you must grant the page access to the camera — on Android through onPermissionRequest, on iOS through the camera permission and the WKWebView delegate. An in-app browser (SFSafariViewController, Chrome Custom Tabs) asks for permission itself.
There are no native iOS and Android SDKs at the moment. The check is embedded in an app through a WebView or an in-app browser — the functions are the same as on a website. If you need a fully custom camera, use the REST API: your backend sends the images.
The widget gives you ready-made capture screens, hints, retakes and frame quality checks: you write only the call and the webhook handling. Your own interface via the API gives full control of the screens, but you build the camera, the frame check and the step errors yourself. The result is the same in both cases — a KYC session and a webhook.
In someone else's (cross-origin) iframe — no: the browser will block the camera and the widget will close, calling closeCb. To embed the widget in a page rather than over it, use the mountElementId parameter — the widget will fill your block.
Yes, in the scenario editor: a logo for the light and dark themes, background, text and button colours, screen texts including the rejection and exhausted-attempts screens, and interface languages. Customisation is included in every plan. The hints during capture, server errors, and country and document names cannot be changed.
Languages are ticked off in the scenario editor — for example Russian, English, Spanish, German, French and Portuguese. The user switches the language in the widget, and the terms and policy are shown in the chosen language.
The widget will show what to fix and offer to retake only that step. Each step gets up to 6 free attempts; after the last failed one the session closes. How to reduce retakes and abandoned checks — on the page on digital onboarding and in our blog.
The result arrives by webhook at your server's address from the scenario settings; it can also be requested by sessionId or clientKey. The successCb callback in the browser is called only on a successful result, so make the decision from the server data.
In the NeuroVision cloud on servers in Russia, or in your perimeter if the platform is installed with you. Original images are stored for 3 months free of charge, the storage period for results is set in the scenario, and the webhook can be sent without personal data. More — on the page «KYC service in Russia».
The widget and customisation are included in every plan: a KYC session with document recognition and anti-fraud — from 16 ₽, with a selfie or a liveness check — from 29 ₽. We give test access for 1 month with a personal account and documentation — leave a request at the bottom of the page.
Can't put your request into words? Book a call and our team will contact you at a convenient time
Book a call
The NeuroVision platform is listed in the Russian software registry, entry no. 19972. Rospatent certificate no. 2023661508.
Address: Moscow, Presnenskaya Embankment 12 — Moscow City business centre, Federation Tower. Nearest metro stations: Delovoy Tsentr and Mezhdunarodnaya.
