1 · Enroll a reference face
Simulates the customer backend sending a reference image. The server returns a sealed token holding the face embedding; nothing is stored server-side.
2 · Run a check (web SDK)
Always active and always against the enrolled reference: the verdict answers "live", "same person" and "did the action". Passive (hold-still) sessions still exist in the API for low-stakes re-checks but are not offered here.
SDK events
3 · Backend verifies the result token
The browser relays the signed result token; the backend checks the Ed25519 signature with the service's public key and reads the verdict. Here /demo/verify stands in for your backend (the server SDKs do the same locally).