Hosted link, QR and invites

The hosted flow is a mobile-first page that needs no account and no app. It works in English and Spanish, and the applicant can switch language.

The link

Creating a session returns url, for example https://YOUR-LEGITFLASH-DOMAIN/v/SESSION-TOKEN. The token is long and random and only a hash is stored, so the link is shown once: when the session is created and when you issue a new link. If you lose it, issue a new link (POST /api/v1/sessions/{id}/link or the dashboard); the old one stops working. Store the session id, not the link.

Pass the applicant's language in locale (en or es) and your own reference in external_reference to find the session later. Never put personal data in metadata.

QR code

qr_svg_url is a signed URL for a QR image of the link, valid for 15 minutes. Show it on a desktop screen or a kiosk so the applicant continues on a phone. When an applicant opens the link on a computer, the page also offers a QR hand-off to their phone.

Email invites

In the dashboard choose New session, enter the applicant's email and send an invite. Through the API pass applicant.email and "send_invite": true (live mode only). LegitFlash emails the link and reminds the applicant if they have not started, then stops. Invites to the same address are limited per day.

Return URLs

When the applicant finishes, the page can send them back to your site: redirect_url in the create request, whose host must be one of the hosts in the flow's success or failure URLs. Do not treat the redirect as proof of the result: read the webhook or the API.

What the applicant sees

Before capturing anything the applicant sees who asks for the data, for what purpose (your purpose text), and how long it is kept. Every step has guidance, and rejections come with a clear reason and a way to retry when that is possible.