OneSDK Implementation Guide

This guide provides a conceptual overview of OneSDK integration with basic code examples. The code snippets shown are illustrative and need to be adapted into your specific framework and application architecture. For complete, working examples:

See our Framework Integration Guides for Angular, React, Vue.js, Next.js and other frameworks
Visit our GitHub repository for extensive sample code and reference implementations
Check out our Hosted Implementation Examples for end-to-end solutions hosted by FrankieOne

Core Modules Overview

Individual Module

Complete KYC workflow for individual verification, including document handling, address verification, and profile management.

Biometrics Module

Advanced biometric verification capabilities including facial recognition, liveness detection, and matching.

OCR Module

Intelligent document scanning and data extraction for IDs, passports, and other verification documents.

IDV Module

Comprehensive identity document verification with support for multiple document types across jurisdictions.

eKYC Form Module

Customizable electronic Know Your Customer forms with built-in validation and compliance checks.

Fraud Detection Module

Real-time fraud prevention and detection across multiple risk vectors.

OneSDK Modules Data Capture Flow

Quick Integration Guide

Install OneSDK

npm install @frankieone/one-sdk

Initialize the SDK

Note: The sample code below is just an example. Never generate tokens on the frontend — doing so can expose your credentials. Always generate tokens securely on your backend and pass them to your app as needed.

import OneSdk from "@frankieone/one-sdk";
// fetch your token
const tokenResultRaw = await fetch(
  "https://backend.kycaml.uat.frankiefinancial.io/auth/v2/machine-session",
  {
    method: "POST",
    headers: {
      authorization: "machine " + btoa(`${CUSTOMER_ID}:${API_KEY}`),
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      permissions: {
        preset: "one-sdk",
        // you can pass either your own unique customer reference
        // or if entity already created/existed, you can pass it's ID here
        reference: "customer-reference",
        entityId: "abc-def-ghi",
      },
    }),
  },
);

const oneSdk = await OneSdk({
  session: tokenResultRaw,
  mode: "production",
  recipe: {
    ocr: {
      maxDocumentCount: 3,
    },
  },
});

Configure Modules

// Example: Initialize Individual and Biometrics modules
const individual = oneSdk.individual();
const biometrics = oneSdk.component("biometrics");

Start Verification

// Example: Mounting Biometrics Component
biometrics.mount("#bio-el");

biometrics.on("detection_complete", (event) => {
  console.log("Biometric capture completed");
});

biometrics.on("results", (results) => {
  console.log("Verification results:", results);
});

Implementation Best Practices

Error Handling

try {
  await individual.submit();
} catch (error) {
  if (error.code === 'CONSENT_REQUIRED') {
    // Handle missing consent
  } else if (error.code === 'VALIDATION_ERROR') {
    // Handle validation errors
  }
}

Module Coordination

// Example: Coordinated verification flow
const verifyUser = async () => {
  // 1. Capture basic information
  await individual.setProfileType('standard_kyc');

  // 2. Perform document verification
  const docResult = await idv.verifyDocument();

  // 3. Run biometric checks
  const bioResult = await biometrics.verifyFace();

  // 4. Submit for final verification
  return individual.submit();
};

Performance Optimization

Initialize modules only when needed and release resources after use. This is especially important for camera-based operations in the Biometrics and OCR modules.

Common Integration Scenarios

Basic KYC
Enhanced Verification

const basicKyc = async () => {
  const individual = oneSdk.individual();
  const idv = oneSdk.idv();

  await individual.addConsent('general');
  await idv.captureDocument('PASSPORT');
  return individual.submit();
};

const enhancedKyc = async () => {
  const individual = oneSdk.individual();
  const biometrics = oneSdk.biometrics();
  const fraud = oneSdk.fraud();

  await individual.setProfileType('enhanced');
  await biometrics.performLivenessCheck();
  await fraud.assess();
  return individual.submit();
};

Each module can be used independently or as part of a comprehensive verification flow. Check individual module documentation for detailed implementation guidelines.

Content Security Policy (CSP) Settings

You may need to adjust your Content Security Policy (CSP) settings to allow vendors’ scripts and resources to load correctly. Below are the additional CSP rules required based on the vendor you are integrating with:

Onfido
Incode
Truuth

Refer to https://documentation.onfido.com/sdk/sdk-csp-guide/#content-security-policy

default-src 'self';
script-src 'report-sample' 'self' 'unsafe-inline' 'unsafe-eval' https://d3vv997wtl2myz.cloudfront.net https://*.incodesmile.com/ wasm-eval https://assets.frankiefinancial.io https://*.incode.com https://*.opentok.com;
style-src 'report-sample' 'self' 'unsafe-inline' https://fonts.googleapis.com;
object-src 'none';
base-uri 'self';
connect-src 'self' https://*.incodesmile.com https://*.i18nexus.com https://d3vv997wtl2myz.cloudfront.net https://featureassets.org https://prodregistryv2.org https://*.frankiefinancial.io https://*.opentok.com https://*.ipify.org data:;
font-src 'self' https://fonts.gstatic.com https://*.frankiefinancial.io data:;
frame-src 'self' https://incode.com https://*.incode.com https://*.incodesmile.com https://*.frankiefinancial.io https://*.frankie.one/;
img-src 'self' data: blob:;
manifest-src 'self';
media-src 'self';
worker-src 'self' blob:;

script-src 'unsafe-inline' 'unsafe-eval' https://cdn.truuth.id https://assets.frankiefinancial.io;
connect-src https://static.au.truuth.id https://portal.api.au.truuth.id https://backend.latest.frankiefinancial.io data:;
img-src 'self' https://static.au.truuth.id data: blob:;

Permissions-Policy (Camera Access)

If your application sends a Permissions-Policy HTTP header, it controls whether the browser lets OneSDK and the vendor SDK use the camera. This is separate from CSP: a page can pass every CSP rule and still never show the camera permission prompt.

camera=() disables the camera for your page and every iframe inside it. The end user is never asked for camera permission, and document capture and biometrics cannot start. Remove camera=() from any page that hosts OneSDK.

Every vendor needs at least self, because OneSDK and several vendor SDKs run directly in your page. Vendors that render their capture screens inside an iframe also need that iframe’s origin, because OneSDK can only pass camera access to an iframe your policy allows.

Vendor	Origins to add to `camera` (in addition to `self`)
Onfido	`"https://*.onfido.com"`
Sumsub	`"https://*.sumsub.com"`
Incode	`"https://.incode.com" "https://.incodesmile.com"`
Daon	`"https://.frankiefinancial.io" "https://.frankie.one" "https://*.trustx.com"`
Truuth, IDVerse, OCR Labs	None. `self` is enough

Permissions-Policy for Onfido

Permissions-Policy: camera=(self "https://*.onfido.com")

If you integrate with more than one vendor, combine their origins in a single camera=(...) allowlist.

OneSDK also passes microphone, fullscreen, accelerometer, gyroscope, magnetometer, and geolocation to vendor iframes. If your policy restricts any of these, apply the same allowlist to them.

API Reference

Detailed API documentation for all OneSDK modules and methods.

Migration Guide

Guide for upgrading from previous versions of OneSDK.

Examples Repository

Sample implementations and integration patterns.

Support Portal

Technical support and implementation assistance.

​Core Modules Overview

Individual Module

Biometrics Module

OCR Module

IDV Module

eKYC Form Module

Fraud Detection Module

​OneSDK Modules Data Capture Flow

​Quick Integration Guide

​Implementation Best Practices

​Common Integration Scenarios

​Content Security Policy (CSP) Settings

​Permissions-Policy (Camera Access)

​Related Resources

API Reference

Migration Guide

Examples Repository

Support Portal

Core Modules Overview

OneSDK Modules Data Capture Flow

Quick Integration Guide

Implementation Best Practices

Common Integration Scenarios

Content Security Policy (CSP) Settings

Permissions-Policy (Camera Access)

Related Resources