Retrieve the profile

Retrieving a profile involves receiving a one-time-use token, and decrypting it to get a user profile.

When a user scans a QR code, Yoti makes a GET request to your callback URL, passing a token as a query string parameter. The token is URL encoded and should be decoded before being used with the Yoti SDK.

For a URL set as https://your-callback-url in Yoti Hub, the returned callback URL would look like the following: https://your-callback-url?token=

You can set and edit the callback URL within your Yoti application under the Integration tab. Yoti will automatically prefix the URL with your domain.

When your web application receives a token via the exposed endpoint as a query string parameter, you can easily retrieve the user profile. The user profile object provides a set of attributes corresponding to the user attributes you specified during the creation of your Yoti application on Hub.

SDK process

When you pass the token to the Yoti Client object, the SDK does the following:

  • Decrypts the wrapped receipt key attribute, using the application private key.
  • Uses the decrypted key to decrypt the other party profile content attribute.
  • Decodes the decrypted profile and returns it to your application.

The profile attributes are central to the SDK and allow you to see and work with the information that your users share with you.

Javascript
Java
PHP
Python
C#
Go
Ruby
Copy
Sandbox
To see how to do this using our sandbox, please head over to the link below.

Well done! This is the end of the integration!

Sources and Verifiers

As discussed earlier, you have a choice to allow unverified attributes like full name and address. Before completing the share, the end-user can get the attribute verified. However, if they decide to share the attribute without verification, the share will still go through but the attribute will be unverified. In order to check the verification status for a profile attribute, you can retrieve its source and verifier as describe above.

As an example, if the user has manually entered their address without verification, the postal_address attribute will have a source of USER_PROVIDED and verifier will be blank. If however, they chose to verify their address before sharing, the attribute verifier will be YOTI_IDENTITY and the sub type will contain the processing method of its verification.

Type to search, ESC to discard
Type to search, ESC to discard
Type to search, ESC to discard