Dashboard

Hosted Flows Guide

Last Updated: May 2026

For most business users, the easiest way to launch a hosted verification page is through VerifyFlow — VerifyFlow is the no-code entry point that manages hosted page creation, test pages, and branding for you.

This page covers the underlying hosted page system for developers who need to create and manage hosted pages directly via API or dashboard.

Generate secure, customizable verification pages without writing code. Perfect for quick implementation, non-technical teams, or businesses that need a turnkey verification solution.

📋 Table of Contents

Overview

Hosted Flows are secure, whitelabeled verification pages hosted on VerifyHuman's infrastructure. They provide a complete verification experience without requiring any coding or backend integration.

Benefits

✅ No Coding Required - Generate verification pages through our wizard
✅ Secure by Default - HTTPS, token-based access, auto-expiration
✅ Fully Customizable - Branding, colors, logos, messages
✅ Mobile-Optimized - Responsive design for all devices
✅ Multi-Step Flows - Guided verification workflows
✅ Retry Functionality - Allow users to retry failed verifications
✅ Webhook Notifications - Get notified when verifications complete
✅ Analytics Dashboard - Track verification success rates

When to Use Hosted Flows

Perfect for:

Use API/Widgets instead if:

How It Works

  1. Create Flow → Use our wizard to configure settings and branding
  2. Generate Link → Get a unique, secure verification URL
  3. Share Link → Send via email, SMS, or embed on your site
  4. User Verifies → User completes verification on hosted page
  5. Get Notified → Receive webhook notification with results
  6. View Results → Check verification status in dashboard

Creating a Hosted Flow

Step 1: Access the Wizard

  1. Log in to your Dashboard
  2. Navigate to Hosted Flows in the sidebar
  3. Click "Create New Flow"
  4. Select your verification product:
    • VerifyHuman (Bot Detection)
    • VerifyAge (Age Verification)
    • VerifyIdentity (KYC)
    • VerifyTrust (trust review)

Step 2: Configure Settings

Basic Settings

Setting Description Example
Flow Name Internal name for this flow "Signup Verification"
API Key Select product-specific API key vhk-a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6...
Redirect URL Where to send users after verification https://yoursite.com/welcome
Expiration How long link is valid 24 hours, 7 days, 30 days
Single Use Allow only one verification per link Yes / No

Advanced Settings

Setting Description Default
Max Attempts Retry limit before lockout 3 attempts
Require Email Collect user email before verification No
Webhook URL Send verification results to this URL Optional
Custom Fields Collect additional user data Optional
Success Message Custom message shown on success "Verification successful!"
Failure Message Custom message shown on failure "Verification failed. Try again."

Step 3: Customize Branding

Logo & Colors

Messages & Text

Step 4: Generate & Share

  1. Click "Generate Flow"
  2. Copy the unique verification URL
  3. Share via email, SMS, QR code, or embed

Example Generated URL:

https://verify.verifyhuman.io/flow/vh_abc123xyz456

Product-Specific Flows

VerifyHuman Flow

Simple bot detection and liveness verification.

Flow Steps:

  1. Landing Page - Welcome message and instructions
  2. Camera Access - Request camera permission
  3. Capture Selfie - User takes selfie
  4. Processing - AI verification (1-2 seconds)
  5. Result - Success/failure message
  6. Redirect - Send to your success URL (optional)

Configuration Options:

Use Cases:

VerifyAge Flow

Multi-step age verification with AI age estimation and optional ID verification.

Flow Steps:

  1. Welcome - Age requirement notice
  2. DOB Entry - Collect date of birth
  3. DOB Check - Confirm user is old enough (instant)
  4. Selfie Capture - AI age estimation
  5. ID Upload (if needed) - Backup verification
  6. Result - Age verified or denied
  7. Redirect - Age-gated content access

Configuration Options:

Use Cases:

VerifyIdentity Flow

KYC verification with selfie + government ID.

Flow Steps:

  1. Welcome - KYC requirements explanation
  2. Data Collection (optional) - Name, DOB, address
  3. Selfie Capture - Liveness check
  4. ID Front Upload - Government ID front
  5. ID Back Upload (optional) - ID back side
  6. Processing - Face matching & OCR (3-5 seconds)
  7. Result - Identity verified or failed
  8. Redirect - Account activation

Configuration Options:

Use Cases:

VerifyTrust Flow

Trust review screening flow with identity verification and structured screening signals.

Flow Steps:

  1. Welcome - Verification requirements notice
  2. Data Collection - Name, DOB, gender (optional)
  3. Selfie Capture - Liveness detection
  4. ID Front Upload - Government ID
  5. ID Back Upload (optional)
  6. Identity Processing - Face matching & OCR
  7. Screening - Structured screening signal check
  8. Result - Clear or review signals returned
  9. Report Generation (if hits) - Encrypted PDF
  10. Redirect - Conditional based on result

Configuration Options:

Use Cases:

Note: VerifyTrust requires Pro or Enterprise plan.

Customization Options

Branding

Make the hosted page feel like your own:

Logo: https://yoursite.com/logo.png
Primary Color: #10b981
Background: #ffffff
Button Color: #3b82f6
Font: Inter, Helvetica, sans-serif

Preview: Real-time preview in wizard shows your branding

Custom Messages

Personalize all user-facing text:

Page Title:

"Verify Your Identity to Continue"

Page Description:

"We need to verify your identity to comply with regulations. 
This process takes less than 2 minutes and your data is never stored."

Success Message:

"✓ Verification Successful! Redirecting to your account..."

Failure Message:

"✗ Verification failed. Please ensure good lighting and try again."

Conditional Redirects

Redirect users based on verification outcome:

Outcome Redirect URL Example
Success Approved page https://yoursite.com/verified
Failure Retry page https://yoursite.com/retry
Expired Contact support https://yoursite.com/support
Compliance Hit Manual review https://yoursite.com/review

Webhook Integration

Receive real-time verification notifications:

Webhook URL: https://yoursite.com/api/webhooks/verification

Payload Example:

{
  "event": "verification.completed",
  "flow_id": "flow_abc123",
  "verification_id": "ver_xyz789",
  "status": "PASS",
  "confidence": 95.7,
  "timestamp": "2025-01-15T10:30:00Z",
  "user_data": {
    "email": "user@example.com",
    "custom_fields": { }
  }
}

Sharing & Embedding

Share the generated URL directly:

https://verify.verifyhuman.io/flow/vh_abc123xyz456

Best for:

Method 2: QR Code

Generate a QR code for the flow URL:

  1. Click "Generate QR Code" in wizard
  2. Download PNG or SVG
  3. Print or display digitally

Best for:

Method 3: Embed on Website

Embed the hosted flow in an iframe:

<iframe 
  src="https://verify.verifyhuman.io/flow/vh_abc123xyz456"
  width="100%"
  height="600px"
  frameborder="0"
  allow="camera; microphone">
</iframe>

Best for:

Opening the page in a full browser tab (Methods 1 and 4) is recommended when visitors may be on a desktop: that is where the page offers to continue on the visitor's phone. See Desktop-to-Mobile Continuation.

Method 4: Button Integration

Add a button that opens the flow in a new tab:

<a href="https://verify.verifyhuman.io/flow/vh_abc123xyz456" 
   target="_blank"
   class="verify-button">
  Verify Your Identity
</a>

Desktop-to-Mobile Continuation

A visitor who opens a hosted page on a computer can finish the verification on their phone. The desktop page shows a Continue on your phone card with a QR code and a copy-link fallback, then waits. The visitor scans the code, completes the camera steps on the phone, and the desktop page moves on to your success or failure URL by itself.

This is built into every hosted page for all four products — VerifyHuman, VerifyAge, VerifyIdentity and VerifyTrust. There is nothing to enable, and the visitor can always ignore the card and continue on the computer.

One URL, one attempt per visitor

A hosted page URL (https://app.verifyhuman.io/hosted/v/<page-token>) is a persistent resource: create it once in the dashboard and reuse it indefinitely. Every visitor who opens it gets their own short-lived verification attempt (about 60 minutes). The QR code on the desktop points at that same attempt, so the phone continues it rather than starting a new one:

desktop opens /hosted/v/<page-token>
  -> attempt created          (/hosted/v/<page-token>?attempt=<attempt-token>)
  -> QR shows that same URL
  -> phone scans, joins the SAME attempt, completes the camera steps
  -> desktop polls GET /hosted/status/<attempt-token> and sees the result
  -> both devices are sent to your configured success / failure URL

Because it is one attempt, a verification that moves between devices produces one result, one charge, one Evidence Receipt and one webhook, exactly as if it had stayed on one device.

What the QR code contains

Only the hosted page URL and the opaque attempt token. It never contains your API key or secret, the visitor's personal data, a receipt, a result or any document data. The attempt token is random (384 bits), expires with the attempt, and only works on the page that created it.

Confirming the result on your server

When the attempt finishes, the visitor is redirected to your configured URL with the attempt token appended:

https://yoursite.com/verified?attempt=<attempt-token>

The URL the visitor lands on is not proof of the result. Confirm it server-to-server with the public status endpoint (no API key is needed or sent):

curl https://app.verifyhuman.io/hosted/status/<attempt-token>

{
  "success": true,
  "status": "completed",
  "completed": true,
  "expired": false,
  "label": "Verification completed",
  "verification_id": "ver_...",
  "redirect_url": "https://yoursite.com/verified?attempt=<attempt-token>"
}
status Meaning
pending, in_progress Not finished yet (for example still on the phone)
completed Passed (completed: true)
needs_review Awaiting manual review — no redirect is issued for this outcome
blocked, error Not verified
expired Unknown or expired token (returned with HTTP 404; the two are indistinguishable)

Treat each attempt token as single-use in your own system: apply its result once, then ignore repeats. Your existing webhooks and Evidence Receipts are unchanged and remain available for the same verification_id.

Notes on the redirect:

Using it from other integrations

Integration How it gets continuation
Direct link, button, email, QR poster Automatically — it is a hosted page
Website widgets (/widget.js, /static/verifyage.js) Pass hostedUrl to init(); the widget then offers Continue on this device or Continue on mobile, and shows this QR / link handoff inside the widget without leaving your page. The VerifyHuman and VerifyAge Wizards, the Code Snippets page and published VerifyFlow VerifyHuman widget flows add it automatically; on a published VerifyFlow VerifyAge widget flow, turn on Mobile continuation. onSuccess receives the same result as on the visitor's own device. See the Widget Guide.
Server SDKs (Python, Node.js, PHP) Send visitors to your hosted page URL, then call resolve_hosted_return() / resolveHostedReturn() on the return request. See the SDK Guide.
Direct API 1. Create the hosted page once in the dashboard. 2. Send the visitor to its URL. 3. On return, read attempt and call GET /hosted/status/<attempt-token>. 4. Receive the usual webhook and Evidence Receipt.
WordPress plugin Versions that send visitors to a hosted page inherit continuation and confirm the result with /hosted/status.

Mobile continuation is optional everywhere. Integrations that do not use it keep working unchanged.

Security Features

Token-Based Access

Each flow URL contains a unique, cryptographically secure token:

https://verify.verifyhuman.io/flow/vh_a1b2c3d4e5f6g7h8i9j0
                                    └─────────────┘
                                    Unique token

Persistent Pages, Short-Lived Attempts

A hosted page URL stays valid and can be shared with many visitors. Each visit gets its own verification attempt, which expires after about 60 minutes if it is not finished; after that the visitor simply reopens your page URL to start again. Reloading the page resumes the same attempt rather than resetting the retry limit, and one visitor's attempt can never be continued on another visitor's page.

HTTPS Encryption

All hosted flows use HTTPS (TLS 1.3):

XSS Protection

Hosted flows include security hardening:

Rate Limiting

Protection against abuse:

Use Cases

1. Customer Onboarding

Scenario: Verify new customers during account signup

Implementation:

  1. Create VerifyIdentity hosted flow
  2. Set redirect to account dashboard
  3. Send flow URL in welcome email
  4. Webhook notifies backend on success
  5. Auto-activate user account

Benefits:

2. Age-Gated E-Commerce

Scenario: Verify age before allowing alcohol purchases

Implementation:

  1. Create VerifyAge flow (use case: alcohol, min age: 21)
  2. Embed on checkout page
  3. Require verification before payment
  4. Store verification ID with order
  5. Webhook confirms age verification

Benefits:

3. Event Check-In

Scenario: Verify attendees at physical events

Implementation:

  1. Create VerifyHuman flow
  2. Generate QR code
  3. Display QR code at entrance
  4. Attendees scan & verify
  5. Dashboard shows verified count

Benefits:

4. Compliance Screening

Scenario: Screen high-value customers for AML/PEP

Implementation:

  1. Create VerifyTrust flow
  2. Set webhook for compliance hits
  3. Send flow URL to customer
  4. Customer completes KYC+ screening
  5. Receive webhook notification
  6. Manual review if hits detected

Benefits:

Analytics & Tracking

View hosted flow performance in your dashboard:

Metrics:

Export Data:

FAQ

General Questions

Q: How much do hosted flows cost?

A: Hosted flows consume the same credits as API/widget integrations:

No additional fees for using hosted flows.

Q: Can I create unlimited flows?

A: Yes, all plans allow unlimited hosted flows. You're only charged for successful verifications.

Q: How long does verification take?

A:

Q: Can users retry if verification fails?

A: Yes, you can configure max retry attempts (default: 3). Users can retry with different photos or better lighting.

Technical Questions

Q: Do hosted flows work on mobile?

A: Yes, all flows are fully mobile-responsive and support mobile camera access.

Q: Can I use my own domain?

A: Enterprise customers can use custom domains (e.g., verify.yourcompany.com). Contact sales for setup.

Q: Do I need HTTPS on my redirect URL?

A: No requirement, but HTTPS is recommended for security.

Q: Can I track conversion in Google Analytics?

A: Yes, add your GA tracking ID in flow settings. We'll fire events for:

Privacy & Security

Q: Is user data stored?

A: No. Images are processed in-memory and immediately discarded. Only verification results (ID, status, confidence) are stored.

Q: Can I delete flow data?

A: Yes, you can delete flows and all associated verification data from your dashboard.

Q: Are hosted flows GDPR compliant?

A: Hosted flows are built with a privacy-first architecture. We process verification data as a data processor. Biometric media is discarded immediately after processing and is not stored. For specific GDPR or CCPA compliance questions, review your data processing agreement or contact support.

Support

Need help with hosted flows?