# Incode iOS SDK Reference

The Incode iOS SDK (`IncdOnboarding`) adds end-to-end identity verification (IDV) to your app. The UI supports custom themes, so IDV looks and feels like your product. The iOS SDK exposes a single public entry point, `IncdOnboardingManager.shared`, and is organized into **modules** (capture and verification steps). Those modules are orchestrated into **flows** and presented to the end user, with results delivered back to your app through the `IncdOnboardingDelegate`. The SDK ships as an `IncdOnboarding.xcframework` through Swift Package Manager, CocoaPods, or a manual binary. This page explains what the SDK can do and how it works.

***

## Capabilities

The Incode iOS SDK supports:

- **Identity capture**: ID scan, document capture, and [Optical Character Recognition (OCR)](https://developer.incode.com/docs/glossary#ocr) data extraction.
- **Liveness and biometrics**: Selfie capture, video selfie, liveness detection, and face match.
- **NFC**: Data extraction from [Near Field Communication (NFC)](https://developer.incode.com/docs/glossary#nfc-scan) chips in passports and supported ID documents.
- **Compliance and risk**: Government validation, watchlist screening, and antifraud analysis.
- **Data collection**: Consents, electronic signatures, phone and email, geolocation, and custom forms.
- **Customization**: Theming, localization, and custom assets so the IDV experience matches your brand.

***

## Integration Approaches

The SDK supports three integration paths, each offering a different level of UI control. Start with the simplest path that meets your requirements.

- **Full Onboarding Flow**: The SDK owns the full UI from start to finish. Run a Dashboard-defined Flow or Workflow (`startFlow` / `startWorkflow`), or a flow you define in code (`startOnboarding`).
- **Section-by-Section**: You own the order of steps and the screens between them, running one section at a time (`startOnboardingSection`).
- **Capture-Only**: You own the UI before and after capture; Incode owns only the capture UI. See [Capture-Only Mode](https://developer.incode.com/docs/ios-capture-only-sdk).

For the full breakdown of how a flow is defined and executed, see [Integration Approaches](https://developer.incode.com/docs/ios-flow-configuration).

***

## Runtime Modes

The mode controls when and whether captured data is sent to Incode for processing. Regardless of the integration path you choose, the SDK runs in one of three modes, selected through the `SDKMode` value on `IncdOnboardingManager.shared`:

- **Standard** (`.standard`): Captures **and** submits to the Incode backend as IDV runs; results are returned through the delegate. The default.
- **Capture-Only** (`.captureOnly`): Captures on-device without sending anything to Incode. You submit from your back end.
- **Submit-Only** (`.submitOnly`): Submits previously captured data without showing capture UI.

```swift
IncdOnboardingManager.shared.sdkMode = .standard
```

In the **Public** distribution variant, `captureOnly` is restricted and reverts to `standard`.

See [SDK Modes](https://developer.incode.com/docs/ios-sdk-modes) for where `sdkMode` sits among the SDK's other configuration properties.

***

## Distribution and Variants

The SDK is distributed as `IncdOnboarding.xcframework` through three channels: Swift Package Manager, CocoaPods, or a manual binary. It ships in build variants. A variant is a linking type plus a set of optional features. Not every module is compiled into every variant, and calling an API for a feature that is not included triggers a runtime variant assertion. Pin the **exact variant version**; there is no Bill of Materials. Choose the smallest variant that includes the features your flow needs to keep binary size down.

| Variant Suffix | Type    | Description                                                                                                                                         |
| :------------- | :------ | :-------------------------------------------------------------------------------------------------------------------------------------------------- |
| `-d`           | Linking | Dynamic linking. The default.                                                                                                                       |
| `-s`           | Linking | Static linking. Required for [On-Demand Resources (ODR)](https://developer.incode.com/docs/setup-ios#manage-on-demand-resources-odr). |
| `-vc`          | Feature | [Video Conference](https://developer.incode.com/docs/module-conference) and streaming.                                                |
| `-l`           | Feature | Local [face login and authentication](https://developer.incode.com/docs/module-face-authentication#standalone-face-login--l-variant). |
| `-nfc`         | Feature | [NFC](https://developer.incode.com/docs/module-nfc-scan) document scan.                                                               |
| `-ra`          | Feature | [Risk Analysis](https://developer.incode.com/docs/ios-risk-analysis).                                                                 |
| `-sna`         | Feature | [Silent Network Authentication](https://developer.incode.com/docs/module-phone#enable-silent-network-authentication).                 |
| `-tri`         | Feature | Transactional Risk Intelligence.                                                                                                                    |
| `-m`           | Feature | Local face mask check (removed since 5.19.0; now included in all variants)                                                                          |

A variant version reads as `MAJOR.MINOR.PATCH-LinkingType[-Feature…]`: for example, `5.31.0-d` (dynamic) or `5.31.1-d-l` (dynamic + login). See [Installation](https://developer.incode.com/docs/setup-ios).

***

## Device Requirements

The SDK runs on physical iOS devices that meet the following minimum requirements:

- **Minimum iOS version:** iOS 13.0
- **Camera:** Required for the [ID Capture](https://developer.incode.com/docs/module-id-scan), [Selfie](https://developer.incode.com/docs/module-selfie), [Face Authentication](https://developer.incode.com/docs/module-face-authentication), [Video Conference](https://developer.incode.com/docs/module-conference), and [Video Selfie](https://developer.incode.com/docs/module-video-selfie) modules.
- **Microphone:** Required for the Video Conference module. Required for the Video Selfie module when audio or voice consent is enabled.
- **Location:** Required for the [Geolocation](https://developer.incode.com/docs/module-geolocation) module.
- **NFC hardware:** Required for the [NFC](https://developer.incode.com/docs/module-nfc-scan) module, on NFC-capable devices and only in the NFC (`-nfc`) variant.
- **Network:** An active HTTPS connection to the Incode Platform.

Declare the matching `Info.plist` usage keys for the capabilities your flow uses. See [Installation](https://developer.incode.com/docs/setup-ios).

***

## Data Handling and Privacy

The SDK runs the on-device half of identity verification. At a high level:

- **On-device capture and inference**: ID images, selfie and liveness video, and NFC chip data are captured on the device. On-device ML models extract their features locally. These models cover liveness detection, presentation-attack detection, face recognition, ID face detection, face occlusion, and age estimation.
- **Encrypted transmission**: Artifacts and verification requests are sent to the Incode Platform over an encrypted channel. You can also enforce end-to-end encryption, which uses Apple's native cryptography (RSA-OAEP with SHA-256 for key exchange and AES-GCM via CryptoKit for payloads). See [Security](https://developer.incode.com/docs/ios-security).
- **No sensitive logging**: The SDK does not log personally identifiable information (PII) or capture content. It ships a privacy manifest (`PrivacyInfo.xcprivacy`) declaring no tracking.
- **Server-authoritative result**: The Incode Platform holds the authoritative verification result for your back end to consume server-side. The SDK reports each module's outcome to your app through the `IncdOnboardingDelegate`.
- **Transient local state**: The SDK keeps only transient, encrypted session state on the device. Call `deleteLocalUserData()` when you are finished with a session.

***

## What's Next

Use the table below to find the page you need.

| Task                                               | Page                                                                                             |
| -------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
| Learn the correct order of steps to set up the SDK | [Getting Started](https://developer.incode.com/docs/ios-getting-started)           |
| Add the SDK to your project                        | [Installation](https://developer.incode.com/docs/setup-ios)                        |
| Choose how your flow is defined and executed       | [Integration Approaches](https://developer.incode.com/docs/ios-flow-configuration) |
| Capture data without sending it to Incode          | [Capture-Only Mode](https://developer.incode.com/docs/ios-capture-only-sdk)        |
| Browse modules and their configuration options     | [Modules](https://developer.incode.com/docs/ios-individual-modules)                |
| Read documents via NFC                             | [NFC](https://developer.incode.com/docs/module-nfc-scan)                           |
| Customize colors, fonts, and text                  | [Customization](https://developer.incode.com/docs/ios-customization)               |
| Add fraud and risk signals to your flow            | [Risk Analysis](https://developer.incode.com/docs/ios-risk-analysis)               |
| Solve a build problem                              | [Troubleshooting](https://developer.incode.com/docs/ios-troubleshooting)           |
| Browse the full public API                         | [API Reference](https://developer.incode.com/docs/ios-api-reference)               |
| Look up result and error objects by module         | [Results](https://developer.incode.com/docs/ios-results)                           |
| Secure the integration (E2EE, SSL pinning)         | [Security](https://developer.incode.com/docs/ios-security)                         |
| Upgrade an existing integration                    | [Migration Guide](https://developer.incode.com/docs/migration_guide)               |
| Check what changed in a release                    | [iOS SDK Release Notes](https://developer.incode.com/docs/releases-ios-sdk)        |

For help, contact your enterprise customer success manager or email [help@incode.com](mailto:help@incode.com).