Start a disclosure

Use the Ver.iD JavaScript SDK to create the authorization request, keep the PKCE verifier, finalize the callback, and verify the disclosure token.

The SDK discovers and calls the OAuth issuer's intent endpoint when you create an intent.

Copy the issuer URI and client identifier from the active disclosure's Configuration tab. The redirect URI must be registered on the disclosure.

Direct flow

Use the direct flow when the configuration in Studio is enough for every request.

yarn add @ver-id/browser-client

import { VeridDisclosureClient } from '@ver-id/browser-client';

const disclosureClient = new VeridDisclosureClient({
  issuerUri: '<ISSUER_URI>',
  clientId: '<DISCLOSURE_CLIENT_ID>',
  redirectUri: 'https://example.com/disclosure/callback',
});

const { disclosureUrl } =
  await disclosureClient.generateDisclosureUrl();

window.location.assign(disclosureUrl);

On the registered callback page, create the same client and finalize the flow:

import { assertDisclosureV1JwtPayload } from '@ver-id/browser-client';

const disclosureResponse = await disclosureClient.finalize();
const disclosureToken = await disclosureClient.decode(
  disclosureResponse,
  assertDisclosureV1JwtPayload,
);

decode verifies the access-token JWT before returning its header and payload.

Flow with an intent

Create an intent when one request needs settings that differ from the default flow configuration.

const { codeChallenge, state } =
  await disclosureClient.generateCodeChallenge();

const intentId = await disclosureClient.createDisclosureIntent(
  {
    challenge: '<OPTIONAL_CHALLENGE_UUID>',
    brandUuid: '<OPTIONAL_BRAND_UUID>',
    requireExplicitConsent: true,
  },
  codeChallenge,
);

const { disclosureUrl } =
  await disclosureClient.generateDisclosureUrl({
    state,
    codeChallenge,
    intentId,
  });

window.location.assign(disclosureUrl);

All intent settings are optional:

Setting	Effect
`challenge`	Associates an optional challenge UUID with this run.
`brandUuid`	Uses an active brand attached to the disclosure.
`requireExplicitConsent`	Overrides the consent setting for this run.

Use the same state and codeChallenge when generating the URL. The SDK stores the matching code verifier and uses it when finalizing the callback.

For a server-side integration, use @ver-id/node-client and keep the client secret on the server. Never include a client secret in browser code.

See the complete @ver-id/browser-client disclosure guide for cache options and response types.

Direct flow

Flow with an intent

On this page