End-to-End Encryption (E2EE)

End-to-End Encryption (E2EE) adds an extra layer of security by encrypting data transmitted between the client and the Incode server. The process begins with a key exchange where the client and server share keys for encrypting and decrypting messages.

E2EE is configured in two places: at SDK initialization (to point the SDK at the E2EE server) and on the session (to enable encryption for a specific onboarding session).

Configure the E2EE URL at initialization

Pass e2eeUrl in apiConfig when calling initialize:

await IncodeSdk.initialize({
  apiConfig: {
    key: 'YOUR_API_KEY',
    url: 'YOUR_API_URL',
    e2eeUrl: 'YOUR_E2EE_URL',
  },
});

❗{/* [SME input needed: confirm where customers obtain the e2eeUrl value. Is it provided by Incode, configured on the Dashboard, or generated by the customer's backend? Source-level review couldn't answer this; it's an ops/backend question.] */}

Enable E2EE on a session

Set e2eEncryptionEnabled: true on the sessionConfig for any session that should use end-to-end encryption:

const sessionConfig = {
  e2eEncryptionEnabled: true,
};

sessionConfig has the same shape across startOnboarding(), startOnboardingSection(), startFlow(), startWorkflow(), and setupOnboardingSession(), so this flag applies the same way to all of them. Pass it when setting up an onboarding session or when starting a flow:

await IncodeSdk.setupOnboardingSession({ sessionConfig });

await IncodeSdk.startOnboarding({
  sessionConfig,
  flowConfig,
});

Enable E2EE for Face Login

startFaceLogin() is not part of the onboarding sessionConfig and takes its own e2eeEncryptionEnabled parameter directly in its config object (note the double "e" - this is a separate flag from the onboarding session's e2eEncryptionEnabled):

await IncodeSdk.startFaceLogin({
  showTutorials: true,
  e2eeEncryptionEnabled: true,
});

See Face Login for the full API.