Skip to main content
Use the Web SDK when Link should run inside your browser application. The Web SDK supports callbacks and frontend control over when Link opens and closes.
If you need iframe isolation, use the Web SDK with connectUrl instead of loading Hosted Link inside an iframe. Hosted Link is intended to be launched directly.
User tokens and session links both expire after one hour. Create a fresh user token before initializing Link with userToken, or create a new session link for an active verification before initializing Link with connectUrl.

Before you start

  1. When using a webview component, make sure localStorage is enabled, domStorageEnabled is set to true, and incognito is set to false.
  2. If your security policy limits outgoing traffic, allow Link API calls by whitelisting outgoing traffic from Link with these content sources at minimum:

Initialize with userToken

Use this path for direct embedded Link implementations that use user tokens. Create a user token on your server:
  • New users: create the user via POST /v2/users and use the returned user_token.
  • Returning users: create a new token via POST /v2/user-tokens and use the returned user_token.
Initialize Link with the Web SDK:

Initialize with connectUrl

Use this path when your backend creates a payroll verification session.
  1. Create a session via POST /v2/sessions.
  2. Copy the response link.
  3. Pass that value as connectUrl in your Web SDK initialization.
For banking verification sessions, pass the returned session link to the banking SDK as connectURL. The session URL already determines whether Link runs in Sandbox or Production. Do not pass sandbox with connectUrl.
Embedded Web Link supports callbacks, including onAccountConnected, onAccountError, onClose, and onTokenExpired. For verification workflows, also subscribe to verifications.updated webhooks so your backend can track the verification lifecycle.