End-to-End Encryption (E2EE)

End-to-End Encryption (E2EE) adds a layer of security to communications between the client and Incode's servers by encrypting transmitted data. The client and server first exchange keys for encrypting and decrypting messages. After this exchange, all subsequent communications are encrypted, and only the intended server and client can decrypt them.

Prerequisites

A custom E2EE server URL provided by Incode.

Enable End-to-End Encryption

End-to-End Encryption (E2EE) setup takes three steps: initialize the SDK with a custom server URL, enable E2EE on the session configuration, and pass the session configuration to the SDK.

1. Initialize the SDK with a custom E2EE server

Pass your e2eeUrl to the initializeSDK() method.

cordova.exec(
  function () { console.log("SDK initialized"); },
  function (err) { console.log("Init error:", err); },
  "Cplugin",
  "initializeSDK",
  [
    "YOUR_API_KEY",              // apiKey
    "https://your.api.url",      // apiUrl
    "true",                      // loggingEnabled
    "false",                     // testMode
    "false",                     // isExternalTokenEnabled
    null,                        // clientExperimentId
    "https://your.e2ee.url",     // e2eeUrl — required when using E2EE
    { enabled: false, forceSSLPinning: false } // sslPinningConfig
  ]
);

2. Enable E2EE on the session configuration

Set e2eEncryptionEnabled to true on your sessionConfig.

var sessionConfig = {
  e2eEncryptionEnabled: true,
};

3. Pass the session configuration to the SDK

Pass the configured sessionConfig to either setupOnboardingSession() (for section-based flows):

// Section-based
cordova.exec(
  function (data) { console.log("Session:", data.interviewId, data.token); },
  function (err) { console.log("Error:", err); },
  "Cplugin",
  "setupOnboardingSession",
  [sessionConfig]
);

or to startOnboarding() , startFlow(), or startWorkflow() (for end-to-end flows):

// startOnboarding
cordova.exec(
  function (result) { console.log("Done:", result); },
  function (err) { console.log("Error:", err); },
  "Cplugin",
  "startOnboarding",
  [sessionConfig, flowConfig, recordSessionConfig]
);

// startFlow — dashboard flow, optionally from a module
cordova.exec(
  function (result) { console.log("Done:", result); },
  function (err) { console.log("Error:", err); },
  "Cplugin",
  "startFlow",
  [{ configurationId: "your-flow-id", e2eEncryptionEnabled: true }, "EMAIL"] // moduleId optional
);

// startWorkflow — dashboard workflow, end to end
cordova.exec(
  function (result) { console.log("Done:", result); },
  function (err) { console.log("Error:", err); },
  "Cplugin",
  "startWorkflow",
  [{ configurationId: "your-workflow-id", e2eEncryptionEnabled: true }]
);

Face Login has its own End-to-End Encryption (E2EE) parameter, e2eEncryptionEnabled. E2EE is disabled by default for Face Login and supported on Android only. See Face Login for details.

cordova.exec(
  function (result) { console.log("Face login success:", result); },
  function (err) { console.log("Face login error:", err); },
  "Cplugin",
  "startFaceLogin",
  [{ e2eEncryptionEnabled: true }]
);

Verify End-to-End Encryption is working

If End-to-End Encryption (E2EE) is enabled but not properly configured, the SDK returns an error. If E2EE is working, the SDK sends and receives requests to and from the E2EE server, and the requests themselves are encrypted. Check your logs to confirm.

Contact your Incode representative if you need help diagnosing an E2EE issue.