Skip to main content
Work down this page from first contact to production.

​
1. From us

  • baseUrl, your appCredential, trustOperatorKey, the trust bundle URL, and the policy bundle URL and digest (What you need from us).
  • The platforms you’ll verify, each confirmed to have an SDK pack.
  • Confirmation that production is live for your users’ region. Until then, integrate against the test configuration we give you.

​
2. Decide

  • Your minimum OS, at or above the SDK’s: iOS 14.0 and Android 7.0 (API 24).
  • How your app hashes its user id into userIdHash. Never send the raw id.
  • Your disclosure text, in each language your app supports.

​
3. Integrate

  • Your backend creates a new SDK run for every attempt, and terminates runs the app abandons (Create an SDK run).
  • Your backend handles the webhook, including results that arrive after the user has left the app.
  • Your app pins the version: from: "1.0.0", ~> 1.0 or 1.0.0. Read the changelog before every upgrade.
  • One ZktlsClient per run, and one run at a time, as in the iOS and Android code.
  • Background time held from the attesting phase until runTree returns: ZkTlsLifecycle, plus ZkTlsSessionService on Android.
  • A message for every error case, and no automatic retry.
  • No token, cookie or credential in your logs.

​
4. Test

  • On a real iPhone at your minimum iOS, and on a mid-range and a low-end Android phone.
  • Decline the disclosure. Close the sign-in page. Tap a link off the platform. Leave the app during the hand-off. Switch from Wi-Fi to cellular. Each case ends cleanly, and the user can start again.
  • Your release build (R8 on Android) launches and completes a run.

​
5. Store submission

  • App Store privacy. The SDK’s privacy manifest is included for you. Add its answers to your App Privacy: User ID and Coarse Location, linked to the user, for App Functionality. Then add the data types your verification collects. Details.
  • Google Play Data safety. Declare the SDK’s part, and the permissions and shortService foreground service it adds. Details.
  • Export compliance. Get your counsel’s answer, and set ITSAppUsesNonExemptEncryption in your Info.plist. Details.
  • App Review. Write notes on the sign-in WebView, and provide a working demo account for each platform. Details.
  • Confirm you have the right, under each platform’s terms, to access the account on the user’s behalf (Apple guideline 5.2.2).
  • Add the SDK’s open-source notices to your app’s notices screen.

​
6. Go live

  • Point baseUrl, the bundle URLs and your Partner API key at production.
  • Fetch the trust bundle before every run, and pass its URL as trustBundleUrl.
  • Watch the error cases you log. A Policy or WrongEvidence error that repeats is worth reporting to us.