@xident/browser

Lightweight browser SDK for Xident age and identity verification (~4KB minified).

Redirects users to the Xident verification widget and parses the callback result. No server-side code, no secret keys.

Quick Start

Script Tag (auto-init)

<script
  src="https://sdk.xident.io/xident.min.js"
  integrity="sha384-HASH"
  crossorigin="anonymous"
  data-api-key="pk_live_your_key"
  data-callback-url="https://yoursite.com/verified">
</script>

<button onclick="Xident.verify()">Verify Age</button>

Programmatic

Xident.configure({
  apiKey: 'pk_live_your_key',
  callbackUrl: 'https://yoursite.com/verified',
});

// Start verification (redirects to Xident)
Xident.verify({ userId: 'user-123', minAge: 18 });

// On your callback page, parse the result:
const result = Xident.getVerificationFromUrl();
if (result) {
  console.log(result.token, result.status, result.result);
  // IMPORTANT: Verify the token server-side!
  // GET https://api.xident.io/verify/v1/result/{result.token}
}

npm (React, Vue, Next.js)

npm install @xident/browser

import { Xident } from '@xident/browser';

Xident.configure({
  apiKey: 'pk_live_your_key',
  callbackUrl: 'https://yoursite.com/verified',
});

await Xident.verify();

API

Xident.configure(config)

| Option | Type | Required | Default | Description | |--------|------|----------|---------|-------------| | apiKey | string | Yes | - | Public key (pk_live_* or pk_test_*) | | callbackUrl | string | * | - | URL to redirect after verification | | successUrl | string | * | - | URL for successful verification | | failedUrl | string | * | - | URL for failed verification | | theme | 'light' \| 'dark' \| 'auto' | No | - | Widget theme | | locale | string | No | - | Language code (e.g., 'en', 'de') | | minAge | number | No | 18 | Age threshold | | userId | string | No | auto | User identifier | | onVerified | function | No | - | Callback on success | | onFailed | function | No | - | Callback on failure |

* At least one callback mechanism required: callbackUrl, successUrl+failedUrl, or onVerified/onFailed.

Xident.verify(options?)

Start verification. Returns a Promise that resolves after redirect.

| Option | Type | Description | |--------|------|-------------| | userId | string | Override user ID for this verification | | metadata | Record<string, string> | Custom metadata (max 1KB encoded) | | newTab | boolean | Open in new tab instead of redirect |

Xident.getVerificationFromUrl()

Parse verification result from the callback URL query parameters. Returns { token, status, result } or null.

Other

| Method | Description | |--------|-------------| | Xident.isConfigured() | Check if SDK is ready | | Xident.getConfig() | Get current config (read-only) | | Xident.version | SDK version string | | Xident.start() | Deprecated alias for verify() | | Xident.getSessionFromUrl() | Deprecated alias for getVerificationFromUrl() |

Security

• Only accepts public keys (pk_live_*, pk_test_*). Secret keys (sk_*) are rejected with a clear error.
• All URLs must be HTTPS (localhost allowed for development).
• API requests are restricted to api.xident.io and localhost.
• Always verify the token server-side. Never trust client-side results.
• Add Subresource Integrity when loading from CDN.

Development

npm install
npm test            # Run tests
npm run build       # Build dist/xident.min.js

License

MIT