It starts with one POST and ends with a signed webhook.

curl -X POST https://api.idotta.com/v1/sessions/ \
  -H "X-Api-Key: $IDOTTA_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "applicant_external_id": "user-42",
        "modules": ["document", "liveness"] }'

# → 201
{ "session_id": "550e8400-…",
  "access_token": "eyJ…",
  "sdk_url": "https://verify.idotta.com/session/550e8400-…?token=eyJ…",
  "status": "created",
  "environment": "sandbox",
  "expires_at": "2026-09-20T13:00:00Z" }

const res = await fetch("https://api.idotta.com/v1/sessions/", {
  method: "POST",
  headers: {
    "X-Api-Key": process.env.IDOTTA_KEY,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    applicant_external_id: "user-42",
    modules: ["document", "liveness"],
  }),
});

const { sdk_url } = await res.json();
// Kullanıcıyı sdk_url'e gönderin — API anahtarı tarayıcıya inmez.

import os, requests

r = requests.post(
    "https://api.idotta.com/v1/sessions/",
    headers={"X-Api-Key": os.environ["IDOTTA_KEY"]},
    json={"applicant_external_id": "user-42",
          "modules": ["document", "liveness"]},
    timeout=10,
)
r.raise_for_status()
session = r.json()   # session_id · access_token · sdk_url

import 'package:idv_sdk/idv_sdk.dart';

// session_id + token backend'inizden gelir — API anahtarı uygulamaya gömülmez
final result = await IdvSdk.startVerification(
  context,
  baseUrl: 'https://api.idotta.com',
  sessionId: sessionId,
  token: accessToken,   // 15 dk geçerli
);

switch (result?.status) {
  case 'approved':  // doğrulandı
  case 'review':    // manuel incelemede — webhook'u bekleyin
  case 'rejected':  // reddedildi
  case 'expired':   // oturum süresi doldu
  case null:        // kullanıcı akıştan çıktı
}

# Başlıklar
X-Signature:  sha256=<hex>
X-Event-Id:   <uuid>
X-Event-Type: session.approved

# Python doğrulama
import hmac, hashlib

def verify(raw_body: bytes, header: str, secret: str) -> bool:
    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(header.removeprefix("sha256="), expected)

# Teslim edilemeyen webhook artan aralıklarla (30 sn → 1 sa) 5 kez denenir.