Third-Party Dependencies

📘
This guide is specific to Web SDK 2.0. If you are still using 1.x, you can find documentation here. Contact your Incode Representative for upgrade information and check if you are a candidate for this upgrade.

Full rollout to all clients still TBD.

The Incode Web SDK loads some resources from domains outside your configured apiURL. This page lists those external network requests — what they're for, and how to remove, replace, or self-host them. Use it to configure Content-Security-Policy allowlists or to run a fully self-hosted deployment.

Summary

Resource	Domain	Package	Default	Override
WASM + ML models	`cdn.incodesmile.com`	`@incodetech/core`	Loaded when `wasm` is set	`setup({ wasm: { wasmPath, modelsBasePath, ... } })`
Public IP lookup	`api.ipify.org`	`@incodetech/core`	Enabled	`setup({ ipLookup: false })`
Translations	`api.i18nexus.com`	`@incodetech/web`	Runtime fetch per language	`setup({ i18n: { loadPath \| skipRemoteLoad, translations } })`

Fonts and animations are bundled in @incodetech/web — they don't hit third-party domains and aren't listed here.

@incodetech/web's setup() forwards ipLookup and fingerprint to @incodetech/core and applies i18n internally.

WASM / ML models

What: WASM binaries, glue JavaScript, and ML models for face and ID capture.

Default domain: cdn.incodesmile.com

Override individual paths, or point at your own host entirely:

import { setup } from '@incodetech/core';

await setup({
  apiURL: 'https://api.incode.com',
  wasm: {
    wasmPath: '/wasm/webLib.wasm',
    glueCodePath: '/wasm/webLib.js',
    modelsBasePath: '/wasm/models',
  },
});

See WASM Configuration for the full self-hosting walkthrough, including required headers and SIMD variants.

Public IP lookup (ipify)

What: Fetches the client's public IP address, used to enrich the device-fingerprint submission.

Default domain: api.ipify.org

import { setup } from '@incodetech/core';

await setup({
  apiURL: 'https://api.incode.com',
  ipLookup: false,
});

Set ipLookup: false to skip the third-party call entirely — useful for deployments where outbound calls to third-party services are restricted. See the ipLookup and fingerprint options in API Reference for the full behavior, including what each flag does to fingerprint submission.

Translations (i18nexus)

What: Runtime translation JSON for the SDK's built-in UI strings.

Default domain: api.i18nexus.com

Serve translations from your own host, or bundle them at build time with no runtime fetch at all. See Internationalization for both approaches (loadPath and skipRemoteLoad).

API-driven externals (not SDK-configured)

These URLs come from Incode API responses, not hardcoded SDK constants, so they aren't controlled by a setup() option:

Theme / logo assets
Presigned upload URLs (electronic signature document uploads)
Signed PDF document URLs
Flow redirect URLs (desktop → mobile handoff)
Recording-session WebSocket host (when video recording is enabled)

Configure these in your Incode Dashboard or with your Incode account team.

Navigation-only links

Some modules link to Incode policy pages (for example, terms-of-service or privacy-policy links in consent screens). These are user-initiated navigation, not requests the SDK makes on its own.

Summary

WASM / ML models

Public IP lookup (ipify)

Translations (i18nexus)

API-driven externals (not SDK-configured)

Navigation-only links

See Also