The Incode Platform provides two verification journeys: Onboarding and Authentication. They serve different purposes, involve different flows, and produce different results. Understanding how they relate is essential before designing your integration.
- Onboarding is the process of verifying a new user's identity for the first time and enrolling them in the Incode Platform.
- Authentication (using the Face Authentication module) is the process of confirming that a returning user is the same person who previously enrolled.
Authentication cannot happen before onboarding. A user must successfully complete onboarding before they can be authenticated.
Onboarding
Onboarding is Incode's term for an initial identity verification session. It answers the question: "Is this person who they claim to be?"
During onboarding, the user provides evidence of their identity. This evidence is typically an ID document and a selfie, though you can require additional evidence. The Incode Platform validates that evidence using a combination of OCR, liveness detection, and face matching. It can also include government database checks.
Onboarding Results
A successful onboarding session produces one or both of the following results:
- A verification score: A calculated confidence measure for each module and an overall session score. Your application uses this score to decide whether to automatically approve, request manual review, or automatically reject the user. Scores are created automatically.
- An Incode Identity: A unique identifier linked to the user's facial biometric template. This template is extracted from their selfie. This Identity enables future face authentication. Incode Identities are not created automatically. You must configure them in your Flow or Workflow.
**Warning**
An Incode Identity is created only when you have configured Identity creation in your Flow or Workflow and all verification modules in the onboarding session pass. If any module fails, no Incode Identity is created, and the user cannot be authenticated in the future without completing a new onboarding session.
When to Use Onboarding
Use onboarding when:
- A user is new to your platform and has not been verified before.
- You need to confirm that a user holds a valid government-issued ID.
- You need to verify user's identity against a document or government database for KYC or compliance purposes.
- You are enrolling users who will later return and need to be recognized.
Authentication
Authentication is the process of confirming that a returning user is the person whose Incode Identity was created during onboarding. It relies on the Incode Face Authentication module. Authentication answers the question: "Is this the same person we verified before?"
During authentication, the user provides only a selfie. The platform compares that selfie's facial biometric template against one or more previously enrolled Incode Identities.
Prerequisite
Authentication requires a previously created Incode Identity. A user who has not completed a successful onboarding session that created an Identity cannot be authenticated.
1:1 and 1:N Authentication
The Face Authentication module has two modes:
1:1 (one-to-one) authentication: The user's selfie is compared against a single known Incode Identity. A second factor, called an Authentication Hint, is required to identify which enrolled identity to compare against. The Authentication Hint is typically the
identityID, a unique customer identifier returned when the user was approved during onboarding. It is associated with their Incode Identity. Other unique values associated with the identity can also be used.Use 1:1 authentication when your application already knows which user is attempting to authenticate. This can be a user who has already entered a username or phone number before the face authentication step.
1:N (one-to-many) authentication: The user's selfie is compared against all enrolled Incode Identities in your account's database. The Incode Platform identifies the closest match without requiring the user to provide any other identifying information.
Use 1:N authentication when your application does not know which user is authenticating in advance. This can be in kiosk setups or passwordless login flows where face recognition is the only input.
When to Use Authentication
Use authentication when:
- A user has already been onboarded and enrolled.
- You want to verify that a returning user is the same person who was originally verified, without requiring them to re-submit an ID document.
- You are building a passwordless or biometric login flow.
- You want to confirm a user's identity before authorizing a high-value action.
Authentication Is Not Authorization
Authentication and authorization are different things:
- Authentication verifies an identity, confirms that users are real, and detects common fraudulent behavior.
- Authorization grants or denies access or privileges to resources in your application.
Incode does not provide an authorization layer. Deciding what users are allowed to do is your application's responsibility. Incode returns a result—such as faceMatch: true/false or verified: true/false—and your application decides what action to take.
The Full Lifecycle
The relationship between onboarding and authentication follows a pattern: onboarding happens once, and authentication can happen many times after.
The following process is for a new user:
- An onboarding session is created.
- The user captures their ID and a selfie.
- The modules validate data.
- Their score is calculated.
- The session is approved.
- Their Incode Identity is created, and their customer UUID is returned.
The following process is for a returning user:
- The user captures only a selfie.
- The Incode Platform compares their selfie to their enrolled Incode Identity.
- A
faceMatchresult is returned. - Your app grants or denies access.
Key Objects
The following objects are created and used across the onboarding and authentication lifecycle:
| Object | Created during | Used for |
|---|---|---|
interviewId / Session ID |
Onboarding | Identifying the onboarding session; fetching scores and OCR data |
| Incode Identity | Onboarding (on approval) | The enrolled user record that authentication compares against |
identityID |
Onboarding (on approval) | The Authentication Hint for 1:1 face authentication |
| Facial biometric template | Onboarding (from selfie) | Face comparison during authentication; stored in the Incode Identity |
Authentication transactionId |
Face Authentication | Identifying a specific authentication attempt; required for back-end verification |
Choose the Right Capability
The following scenarios map to the correct capability to use:
| Scenario | Use |
|---|---|
| New user; no prior verification | Onboarding |
| User holds an ID document you need to validate | Onboarding |
| KYC or AML compliance check required | Onboarding |
Returning user who knows their identityID or alternate |
Face Authentication (1:1) |
| Returning user who does do not know their identifier | Face Authentication (1:N) |
| Passwordless or biometric login for enrolled users | Face Authentication |
| Confirming identity before a high-value action | Face Authentication (1:1) |
| Re-verifying an enrolled user's document | Onboarding |
Integration Paths for Each Capability
Both capabilities are available across the same integration types: no-code/low-code, a supported Incode SDK, and the Incode API.
Onboarding Integration Paths
Onboarding integration paths include:
- No-code: Webflow URL
- Low-code: Redirect to Webflow URL with a session token
- Full SDK: Web SDK or mobile SDK with explicit module steps
- API-only: Single or batch onboarding via API endpoints
Authentication Integration Paths
Authentication integration paths include:
- Hosted: 1:N Authentication Links, OIDC Authentication Links
- Web SDK:
renderLogin()method - Mobile SDK:
startFaceLogin()(online 1:1) or offline face login
Integrate by Platform is the recommended starting point for authentication integrations.
Related Pages
- What is Identity Verification?: Detailed information about why you need IDV and how it works
- Incode Face Authentication Foundations: Detailed concepts: biometric templates, Incode Identities, 1:1 vs. 1:N
- Onboarding Session Lifecycle: How a session moves from creation to completion
- Integrate by Platform: Implementation starting point
- Scoring System Explained: How onboarding session scores are calculated and used