It starts with one POST and ends with a signed webhook.

curl -X POST https://api.idotta.com/v1/sessions/ \
  -H "X-Api-Key: $IDOTTA_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "applicant_external_id": "user-42",
        "modules": ["document", "liveness"] }'

# → 201
{ "session_id": "550e8400-…",
  "access_token": "eyJ…",
  "sdk_url": "https://verify.idotta.com/session/550e8400-…?token=eyJ…",
  "status": "not_started",
  "status_label": "Not Started",
  "step": "created",
  "environment": "sandbox",
  "expires_at": "2026-09-20T13:00:00Z" }

const res = await fetch("https://api.idotta.com/v1/sessions/", {
  method: "POST",
  headers: {
    "X-Api-Key": process.env.IDOTTA_KEY,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    applicant_external_id: "user-42",
    modules: ["document", "liveness"],
  }),
});

const { sdk_url } = await res.json();
// Send the user to sdk_url — the API key never reaches the browser.

import os, requests

r = requests.post(
    "https://api.idotta.com/v1/sessions/",
    headers={"X-Api-Key": os.environ["IDOTTA_KEY"]},
    json={"applicant_external_id": "user-42",
          "modules": ["document", "liveness"]},
    timeout=10,
)
r.raise_for_status()
session = r.json()   # session_id · access_token · sdk_url

# Headers
X-Signature:  sha256=<hex>
X-Event-Id:   <uuid>
X-Event-Type: session.approved

# Python verification
import hmac, hashlib

def verify(raw_body: bytes, header: str | None, secret: str) -> bool:
    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest((header or "").removeprefix("sha256="), expected)

# Undelivered webhooks are retried 5 times with growing delays (30 s → 1 h).