Skip to main content
The mobile SDK runs a verification on your user’s phone, inside your app. The user signs in to the platform in a WebView the SDK controls. The SDK then collects the data the verification needs and sends the result to Cr3dentials. Your app never handles the platform’s data. You get the result the same way as from an iframe session: by webhook or by polling. Use the SDK when your product is a native mobile app. For a web product, use the iframe integration. The SDK is licensed under Apache-2.0. Installing it needs no account or token. Releases, the changelog and the full reference docs are at github.com/Cr3dentials/zktls-sdk-releases.

​
How a run works

1

Your backend creates an SDK run

Call POST /partner/browser-session with "channel": "sdk". The response carries a packId, a resultUrl and an accessToken for this run. See Create an SDK run.
2

Your app starts the run

Your app passes those three values to the SDK’s runTree. The SDK shows your disclosure, then opens the platform’s own sign-in page.
3

The user signs in

The user signs in to the platform. Cr3dentials never sees their password. The SDK collects the data the verification needs from inside the page.
4

Cr3dentials checks and stores the result

The result is posted to the run’s resultUrl. Cr3dentials checks the run’s token, the platform’s pack and, for attested data, the enclave’s signature. Then it stores the data.
5

You receive the result

Your webhook fires, and GET /partner/browser-session/{id} returns the extractedData.

​
Observed and attested data

Each platform is described by a pack: a small signed document, written and published by Cr3dentials. It tells the SDK where the platform’s sign-in page is and which of the platform’s endpoints to read. Packs are fetched when a run starts. When a platform changes its pages, we publish a new pack, and your app doesn’t change. A pack produces one or both kinds of data:
  • Observed. The phone reads it from the user’s own signed-in page. Nothing vouches for it beyond the user’s device, so treat it as what that device reported.
  • Attested. Once the user has signed in, the SDK hands the run to an attester. The attester is a Cr3dentials enclave that reads the platform’s figures itself, over TLS, and signs them. Cr3dentials checks that signature before it stores the figures.
For a platform with attested data, the user may close your app as soon as the SDK reports the detached phase. The attester finishes the run without the phone.

​
What you need from us

Email info@cr3dentials.xyz to enable the SDK for your app. We send you:
Your Partner API key stays on your backend. Never ship it in your app. The app gets only the values above, plus each run’s resultUrl and accessToken, which your backend fetches.

​
Next steps

Create an SDK run

The backend call that issues each run.

iOS

Install the Swift package and run a verification.

Android

Add the Gradle dependency and run a verification.

Release checklist

From first build to App Store and Google Play.