Skip to main content
A hosted flow reports its outcome two ways. Use client callbacks to update your UI — but treat the webhook as the source of truth before granting access.

​
Two ways to get the result

Never trust the client for the decision. A user can manipulate the browser. Grant access only after your backend receives and verifies the webhook.

​
Tie sessions together with reference_id

Pass a reference_id (minimum 10 characters) when you launch the flow. It comes back in the callback and the webhook, so you can match the result to the right user. Store it when you start the session.

​
Receive the webhook

Subscribe your backend URL to the kyc_widget service, then verify every event is genuinely from Dojah before acting on it.

​
Check the verification status

The event carries the flow’s status. See Verification statuses for what each value means, or look one up later with the Get verification endpoint.
File links expire. Selfies and documents in the result are temporary URLs — copy them to your own storage right away. See File links & expiry.