Three ways in.

One script tag, a call from your backend, or a link you send to someone. Pick the one that fits how much you want to build, and change your mind later.

Least to build

Embed the widget

One script tag on your page

Drop the verification widget into your site. No build step, no framework requirement, nothing to keep updated.

  • Renders in an iframe, isolated from your page
  • Auto-sizes to its content
  • Callbacks for ready, started, verdict and error
  • Works with a shareable link or a session you created
  • Restrict which of your domains may embed it
<script src="https://verify.cognau.com/embed.js"></script>
<script>
  const v = Cognau.open({
    link: 'cgn_vl_…',
    onVerdict: r => { v.close(); console.log(r.passed, r.sessionId) }
  });
</script>

Production shape

Server API

Create sessions with your secret key

Your backend opens the session, so the browser only ever holds a single-use token and the result arrives somewhere a user cannot touch.

  • Separate test and live keys, with separate data
  • Signed webhooks as the authoritative result
  • Your own reference echoed back for reconciliation
  • Optional monthly quota per account
  • Full session history and audit log
// Your server, with your secret key
POST /api/v1/session/create
Authorization: Bearer cgn_sk_live_…

{
  "platform": "web",
  "clientReference": "user_4821"
}

// Returns a single-use token for the browser
{ "sessionId": "…", "sessionToken": "cgn_st_…" }

Nothing to deploy

Verification links

Send someone a URL

They complete the check, you get the result. Useful for trials, support flows and one-off verifications, with no integration at all.

  • Created from the dashboard or one API call
  • Single use by default, and always expires
  • Revocable instantly
  • Optional redirect back to your own page
  • Same result delivery as any other session
POST /api/v1/cockpit/verification-links
Authorization: Bearer cgn_sk_live_…

{
  "label": "Acme onboarding",
  "clientReference": "user_4821",
  "maxUses": 1
}

// → https://verify.cognau.com/?link=cgn_vl_…

Full reference, including webhook payloads and error codes, is in the documentation.

What happens between the session opening and the result landing.

  1. 1

    The session opens

    Your server creates it with a secret key, or someone opens a link you sent.

  2. 2

    The check runs

    The camera opens and a short sequence of prompts is issued, drawn at random for that session.

  3. 3

    Scoring happens elsewhere

    Frames are read as they arrive, never on the user device, so the result is not something the device can influence.

  4. 4

    The result lands

    A pass or a fail with a confidence score, delivered to your server by signed webhook as verification.completed.

  5. 5

    The capture is pruned

    An abandoned session is deleted within 24 hours. A scored one keeps a small sample as evidence, on a published schedule.

What holds true whichever way you integrate.

Credentials that expire

Encrypted transport, single-use session tokens and time-limited links. Deletion deadlines are enforced by the database rather than by a job somebody can forget to run.

Scored as it runs

Frames are scored as they arrive over a persistent connection, so the result lands as soon as the check itself is over, usually inside a minute.

A sandbox that behaves

Test keys run every path above and let you force a pass or a fail without a camera. Sandbox traffic stores no video and is never billed.

Get a test keyWhat a check costs

Ready to secure your platform?

Confirm a real person is on the other end, before the decision that depends on it. Create an account and run your first check in the sandbox, free.

Start free