Run the FinAuth ID check and face verification flow against the real API, step by step.
For Bastion developers and testers. The method behind each step is in the FinAuth Integration Guide.
How to start
Run the real flow against FinAuth from this page. Type your keys in the page; a small local gateway makes the calls. Every run makes billed calls on your test keys.
Real calls
The calls are billed. AnyDoc bills pages × unit price. RAW flash billing is not documented by FinAuth (OI-17).
The test keys allow QPS 2. The gateway sends one FinAuth call at a time, never retries on its own, and stops after 30 calls in an hour.
The ID image and the AnyDoc fields are real personal data. Use your own ID or an authorised test document. Never screenshot or share results (Master §16).
This page works only when the gateway serves it. It talks only to the gateway. The RAW JS SDK, also served by the gateway, opens its own WebSocket to wss://rtc-sgp.yljz.com. The page never calls FinAuth's HTTPS API. The gateway does, with the keys you type, which it uses for that one call and does not store.
Start the gateway
Double-click the launcher.
Windows: Start FinAuth POC.cmd, in the same folder as this page. Mac or Linux: run ./start-poc.sh in that folder. It uses Node if it is installed. If not, it downloads a portable Node 22 once (about 30 MB, checked against nodejs.org's SHA-256 list) into your user folder. No installer, no admin rights. It then starts the gateway and opens this page.
With Node 18 or later installed, this also works: node finauth-poc-gateway.mjs --open, run in that folder.
Keep the gateway window open.
Closing it stops the gateway. Preflight in the side menu checks the gateway, the keys and this browser.
Enter the keys once, in Settings.
Press Settings: API keys in the side menu and fill in the key and secret per product. They fill every step's API Key and API Secret fields. A change in a step's field updates Settings and the other steps, and the other way round. The keys stay in this browser tab until you close it.
Optional: use a phone, or H5 lite.
Run ngrok http 8787 and open the https://… URL it prints. H5 lite's Public URL field (H1) defaults to the address this page was opened from, so opening the ngrok URL fills it correctly.
ngrok http 8787
Billed calls
Every Run step makes at most one FinAuth call, or up to 3 reads for a result. Nothing retries on its own. Buttons stay disabled while a step runs, so a double click cannot send twice. The same ID image sent again in the same session reuses the earlier AnyDoc answer instead of paying again. The gateway stops after 30 calls in an hour.
Why HTTPS
Step
Needs
Why
Works on localhost?
Works via ngrok?
3 Liveness capture, H2
A secure context
Browsers allow getUserMedia only on HTTPS or localhost.
Yes, on this computer
Yes
H1 Start session
A public HTTPS URL
FinAuth's server must reach notify_url over HTTPS on an allowed port (443 via ngrok). FinAuth cannot reach localhost. Type the public URL in H1's Public URL field.
No
Yes
1 ID check, 2 Liveness session, 4 Result
Neither
The gateway calls FinAuth. The page only talks to the gateway.
Yes
Yes
ngrok's free plan may show a browser warning page on the first visit. Not in FinAuth docs; not tested.
Primary flow
ID check with AnyDoc, then RAW flash liveness with the accepted ID as image_ref1, then raw/get_result and the decision.
1 · ID check (AnyDoc)Not run
In production your backend owns this list. See "Acceptance rule" in the FinAuth Integration Guide.
Request sent by the gateway (redacted)Response (images shortened)
2 · Liveness session (raw/get_token)Not run
Fixed: procedure_type=raw_flash (the only value) and comparison_type=0 (RAW flash always compares, EC-18). The gateway sends the ID accepted in step 1 as image_ref1.
Request sent by the gateway (redacted)Response (images shortened)
3 · Liveness capture (camera)Not run
The SDK loads from the gateway. It talks to host over a WebSocket. 1000 means the capture finished, not that the user is verified.
4 · Result and decision (raw/get_result)Not run
Request sent by the gateway (redacted)Response (images shortened)
H5 lite
FinAuth's hosted page instead of your own capture. On a desktop the page shows a QR code by default, and the capture continues on a phone. orientation_mode=1 is expected to use the desktop's webcam instead Unconfirmed · OI-24.
H1 · Start session (get_token)Not run
Defaults to the address this page was opened from. FinAuth's server must reach it over HTTPS, so localhost will not work: open this page through your ngrok https:// URL, or type that URL here.
Fixed by the gateway: return_url and notify_url under the Public URL, action_http_method=GET, get_fail_reason=1, and fail_when_ref_multiple_faces=0 when comparing.
Request sent by the gateway (redacted)Response (images shortened)
H2 · Open the FinAuth pageNot run
This tab goes to FinAuth's page and comes back through return_url. The gateway keeps the session. This tab keeps the inputs and the session ID. On a desktop, scan the QR code with a phone unless you chose orientation_mode=1.
H3 · Callback received (notify_url)Not run
The page asks the gateway every 2 seconds. It never asks FinAuth. The return to this page is not signed and proves nothing.
H4 · Result and decision (get_result)Not run
Request sent by the gateway (redacted)Response (images shortened)
The Premium SDK cannot run in a browser. It needs a native Android app.
Verdict
VerdictNot run
Verdict—
Reasons—
request_id of each FinAuth call—
FinAuth calls in this run0
Billed: AnyDoc per page when HTTP is 200 and pages is not empty. RAW flash billing is not documented by FinAuth (OI-17). H5 lite bills when the comparison ran or found no face. Repeat get_result reads are not billed.
Tip
The gateway implements the same routes as the reference backend in the FinAuth Integration Guide: POST /kyc/id-check, POST /kyc/liveness and GET /kyc/liveness/{id}/result, plus H5 lite routes. It is copy-and-adapt POC code, not production code: single process, memory only, no user accounts and no access code. Anyone who can open the page can use it, with keys they type.
Preflight: check the gateway, the keys and this browser
Run all runs preflight, then steps 1 to 4, then the verdict. It closes this panel when preflight passes, and stops at the first FAIL or Blocked step with the reason. Every step can also run alone. Running step 2 again gets a new token and a new biz_no.
Settings: API keys
Fills the API Key and API Secret fields of every step. A change here changes the steps, and a change in a step changes this panel. Kept in this browser tab until you close it.