Release notes, Releases Web SDK

Web SDK Release Notes

1.94.0

9 October 2026

Session expiry

  • Any SDK request that answers HTTP 401 now ends the active render* / execute* method: it unmounts and calls that method's own onError once with a SessionExpiredError (statusCode: 401, code / type: 'SESSION_EXPIRED', extends WebClientError). Previously the user was left on a retry screen and the integrator was never notified. This applies whether the method is called on the create() instance or imported from the package root after setup().
  • SessionExpiredError is exported from the package root, and FlowRendererError['type'] (the executeFlow onError payload) gains 'SESSION_EXPIRED'.
  • Direct API methods (processId, ocrData, …) keep throwing WebClientError as before.
  • A failed best-effort device telemetry request no longer ends an otherwise valid session.
  • Fixed the device telemetry request sending an invalid credential after Face Capture, which could drop mobile users onto a "session expired" screen.

Integration required: the SDK no longer shows its own retry screen when the session expires. Handle SESSION_EXPIRED in onError, show your own message, and start a new session:

  import { create, SessionExpiredError } from '@incodetech/welcome';
  const incode = create({ apiURL: 'https://demo-api.incodesmile.com' });
  incode.renderCaptureFace(document.getElementById('camera'), {
    token: session,
    onSuccess: (result) => {
      // step finished
    },
    onError: (err) => {
      if (err instanceof SessionExpiredError || err?.type === 'SESSION_EXPIRED') {
        // the SDK has already unmounted: show a "session expired" message,
        // then create a new session and restart the flow
        return;
      }
      // handle other failures
    },
  });
  • For TypeScript: add a 'SESSION_EXPIRED' case to any exhaustive switch on FlowRendererError['type'].
  • Detection depends on the API returning CORS headers on its 401 responses. Where it does not, the browser hides the status from the SDK and the previous behaviour applies.

ID / Face capture

  • Denying the camera permission on Face Capture or refreshing after a denial no longer advances the Flow or Workflow without a capture. Workflows reload on a permission refresh instead of moving to the next step.
  • UXv1 back-ID-only Flows keep the manual upload option in the document chooser. Manual upload requests only the back image.
  • FiscalQR: denying the camera permission on iOS Safari now shows the camera-permission instructions screen instead of a blank camera view; other camera errors show an inline message.

eKYC

  • Germany DE_PHONE_MOBILE_REGISTER support: first name, last name and phone mandatory; middle name, date of birth and address optional; no state field; 5-digit postal code; phone of 10 to 13 digits including country code.
  • Norway NO_CONS_POP_REG support: first and last name mandatory; date of birth, phone, email and address optional; no state field; 4-digit postal code; 8-digit phone.
  • phoneProfile risk addon: a RISK_ADDONS_ONLY config with riskAddons: ['phoneProfile'] renders only the phone field, prefilled read-only from a prior OTP step.
  • Brazil BR_TAX_PHONE_REGISTER: the ID number field is labelled "CPF" and must be exactly 11 digits.
  • Peru PE_CIVIL_REGISTER_2: show the optional Middle Name field.
  • Fix the Continue button staying disabled with every visible field filled on forms without a state text input (reported for CO and BR sources).

eKYB

  • Austria AT_KYB_PREFILL pre-fill: mandatory Tax ID (FN commercial register number such as FN 123456a, or the ATU + 8-digit VAT number), with optional Business Name and Address.
  • Belgium BE_KYB_PREFILL: the Tax ID accepts the officially printed BCE/KBO formats (0656.908.546, 0656 908 546, 656.908.546, 656 908 546) in addition to the bare number and the BE0 VAT form.

Security, theming & platform

  • Update the ML WASM kit to v2.14.51.
  • The SDK now reports its build as <version>+<short sha> (for example 1.94.0+1a2b3c4) in device fingerprint, capture metadata and i18n. Split on + to get the release line. A version passed to create() / setup() still takes precedence.
  • An empty version passed to create() / setup() now falls back to the built-in SDK version.

Download 1.94.0

1.93.0

11 September 2026

1.93.0

Added

  • ID capture onEvent callback — emits idCapture.started and idCapture.completed per side (front | back | passport) so integrators can observe the front→back boundary when captureMode: 'both'
  • Dynamic form pre-fill from captured ID/OCR — opted-in questions are seeded before render; non-editable fields stay read-only but still submit; fetch failure falls back to a blank, editable form
  • Document capture support for IRS W-8BEN (processW8BenOcr, single-page) and W-8BEN-E (processW8BenEOcr, multi-page)
  • Headless renderWallet surfaces NO_CREDENTIAL when no wallet credential is available; a chooser-less Digital ID-only config reports INCONSISTENT_FLOW_CONFIGURATION instead of a silent dead-end

Fixed

  • Show the ID scan failed message when retry attempts are exhausted, instead of a generic processing error
  • Desktop IDV2 manual-capture preview no longer looks cropped, zoomed, or letterboxed
  • Prevent scrollbar flicker on desktop at some zoom levels; lock scroll during capture when the host page is taller than the viewport
  • Anchor the IDV2 manual capture button to the bottom of the viewport so it cannot land inside the ID frame
  • Improve iOS VoiceOver responsiveness during ID capture by pacing frame processing
  • Honor the Dashboard Enforce Capture Image Attempts setting at runtime — the attempt budget survives refresh, back navigation, and re-init; exhausted budgets emit NO_MORE_TRIES
  • Combined consent now loads in the language selected during the flow
  • Workflow electronic signature respects the configured custom subtitle

Changed

  • US Smart Capture restores the barcode fast path: when the back-side PDF417 barcode is decoded, skip the 3-2-1 countdown and go to the "Hold on" analyzing screen

Download 1.93.0

1.92.1

26 August 2026

1.92.1

Fixed

  • Webpack build issues solved

Download 1.92.1

1.92.0

19 August 2026

1.92.0

Deepsight

  • Configuration and enablement should match dashboard configuration for deepsight to work correctly.

eKYC

  • India ID number support
  • India DMV (IN_DMV) support
  • Nigeria NG_MONO_BVN support
  • UK EKPB prefill
  • Mexico eKYC prefill adjustments
  • Improve apartment-field logic

eKYB

  • W4B dateOfIncorporation support

UIConfig

  • Add uiConfig and onClose to renderCamera('document', …) for per-flow theming and close handling
  import { create } from '@incodetech/welcome';
  const incode = create({ apiURL: 'https://demo-api.incodesmile.com' });
  incode.renderCamera('document', document.getElementById('camera'), {
    token: session, // or rely on create()/start() session
    onSuccess: (result) => {
      // document uploaded / step finished
    },
    onError: (err) => {
      // handle failure
    },
    // Theme / brand this flow without org-level dashboard config
    uiConfig: {
      branding: {
        logo: { src: 'https://cdn.example.com/logo.svg', height: 32 },
        hideFooterBranding: true,
        // hideHeaderBranding: true,
      },
      closeButton: {
        show: true,
        position: 'left', // or 'right'
        // offset: 16,
      },
      theming: {
        designTokens: {
          color: {
            brand: { primary: '#EC0000' },
          },
        },
      },
      helpButton: { show: true },
      // notifications: { minimal: true },
    },
    // Fired when the user taps the X (then the SDK unmounts itself)
    onClose: () => {
      // navigate away, resume host UI, analytics, etc.
    },
  });

ID / Face capture

  • Hide camera loading overlay when continuing from V1 manual ID review
  • Center ID flip ("Show the back of your ID") Lottie animation
  • Center IDV2 manual-capture tooltip text in standalone embeds
  • Fix selfie frame on specific iOS devices
  • Delay Selfie V2 capture frame until camera is visibly playing
  • Honor ChooseCamera deviceId on V1 desktop selfie / face auth (spread props before deviceId)
  • Prevent excess scrollable area on webcam capture pages
  • Text-magnification layout — top text grows downward; manual capture button stays in viewport
  • Samsung/Android Chrome — tab switch no longer flashes permission screen or breaks stream; wait for visibility before getUserMedia; release recorder before retry
  • Force OpenVidu (not OpenTok) for ID/selfie recording sessions in non-production
  • Propagate expired-token init errors to renderCaptureId / renderCaptureFace onError as SESSION_EXPIRED (401)
  • Honor custom tutorialText title/subtitle on every multi-page document tutorial step
  • Honor configured lottieScriptUrl for IDV2 capture-feedback notifications
  • Add crossOrigin="anonymous" to Lottie player loader so cross-origin script errors are not opaque

Security, theming & platform

  • Remove vulnerable bundled uuid — switch recorder to in-repo @incodetech/opentok-react; pin openvidu-browser → uuid 11.1.1
  • SDK deprecation policy — setup() warns once when release is ≥12 months old
  • Share applyDashboardTheme across workflow and flow so workflow buttons pick up brand color

Download 1.92.0

1.91.0

17 July 2026

1.91.0

Fixed

  • Fixed executeWorkflow infinite loading animation displayed after workflow is finished when showFinishScreen: false
  • Fixed typo in ID capture V2 attempts remaining
  • Fixed Electronic Signature - Signature canvas had incorrect sizing and spacing on mobile and tablet
  • Editable and non-editable OCR were wrongly connected to dashboard settings
  • Gov validation | Wrong success message for successful scraping
  • Device specific | Flows | Workflows | Selfie oval is cut off on smaller screens
  • eKYC | Module skipped when country configured as "global"
  • The ID capture zoomed in specific devices
  • Face capture cannot be loaded and is eventually skipped if it isn’t the first module
  • Samsung A14 | Camera stream is lagging significantly
  • Camera was zoomed on some devices with two or more cameras
  • Document Capture - The camera was zoomed
  • Retry attempt was not getting launch | iOS devices
  • ID Capture UXv1 | ID preview was horizontal
  • Video Selfie - White screen when only “speech” module and useOpenVidu was enabled
  • Openvidu is now default and only provider for video recording
  • Overall security and injections attacks fixed

Download 1.91.0

1.90.0

12 June 2026

1.90.0

Minor Changes

  • EKYB desktop improvements
  • US_CREDIT_TELCO support
  • Center face capture error modal title under icon
  • New countries ekyb country grid
  • Fix signature canvas
  • Hk support for ekyb
  • EKYC displayMode support
  • EKYB Address autocomplete
  • Address is mandatory for EKYB china
  • Electronic Signature Layout fix

Patch Changes

  • Fix V2 ID capture bottom UI overlap on wide, short desktop viewports.
  • Center the eKYC information verification loader; refine Permissions layout on large screens; fix the permissions modal close action and primary/secondary button order.
  • Fix V2 ID capture layout
  • Localize USER_CANCELLED messages when closing ID or face capture (errors.userCancelledIdFlow, errors.userCancelledFaceFlow)
  • Reset default browser margins on dl and dd in UserInfo
  • Fix executeWorkflow firing /omni/workflow/info and /omni/workflow/current/node twice when called without a token.
  • Use Stable Version always on i18n fallback
  • Add CDN fallback for translation loading When the primary i18nexus translations endpoint fails (network error or non-2xx response), the SDK now retries the same {lng}/{ns} resource against https://cdn.incodesmile.com/translations/{version}/{lng}/{ns}.json.
  • Update custom watchlist UI to match V2 design: replace modal loader with a shared StatusPage component using design-system Page, LoadingIcon, and SuccessIcon, with updated translation keys and accessibility focus on success.
  • DocumentCapture: hide the upload option when onlyAllowCapture: true is passed. Removed the no-op onlyCapture and nativeCamera props from DocumentCaptureProps.
  • Allow DOUBLE custom field type to accept decimal values
  • Add guards to VideoSelfie buttons
  • Fix EncryptionLabel overlapping the attempts text and primary CTA on desktop ID processing screens (IdAnalyzing, IdSuccess, IdError). The label is now rendered once inside IdProcessingLayout's full-size FrameContainer (matching CaptureOverlay's structure) so its absolute positioning math lines up with the camera frame, instead of being placed inside the maxH: 900 content Flex where the math drifted on tall viewports.
  • In V2 capture flows, when the user loses or revokes camera access mid-session, the camera overlay now shows the Denied instructions component so guidance matches the rest of the V2 permission experience.
  • Disable "Tap when done" in the Video Selfie voice consent step until the recorder has captured at least the minimum required duration of audio. Prevents fast-tap races where the session finished without a voice consent recording attached.

Download 1.90.0

1.89.1

12 May 2026

1.89.1

Fixed

  • Fixed rate of False Negatives

Download 1.89.1

1.89.0

4 May 2026

1.89.0

Added

  • Document Capture design changed to V2, please refer to Figma for more info.
    • nativeCamera options removed, instead, use onlyCapture or onlyUpload.
      • onlyCapture: Will provide regular Incode camera overlay and capture with UI
      • onlyUpload: Will show system's file upload and camera
  • Added support for multiple pages documents on Document Capture V2
  • OTP for CURP improved, now is just one field and detects SMS auto complete.
  • V2 flows can be activated via Dashboard configuration, please check your provisioning to support this on your flows.

Fixed

  • Fixed vulnerabilities on lodash library
  • Do not upload or make unnecessary call for recording on CaptureOnly
  • Biometric consent now shows correctly on certain ID that need it
  • A11Y fixes for Face Capture
  • Fixed transitions and smooth animations for CURP
  • EKYC fields focus in correctly
  • On Workflows, clicking "Refresh Page" button skips ID/Selfie capture

Removed

  • Third ID support is removed

Download 1.89.0

1.88.0

16 March 2026

1.88.0

Added

  • Adds help button config into ui config

  • Add onLog callback support to renderCaptureId and renderCaptureFace

    • onLog callback is now available as an optional parameter in both renderCaptureId and renderCaptureFace methods
    • Callback receives { type: string; payload: { [key: string]: unknown } } - same structure as renderCamera's onLog
    • Enables clients to maintain their tracking logic when migrating from renderCamera to the newer SDK methods
    • V1 and V2 capture flows both support the callback; key events (e.g. captureAttemptFinished) are forwarded to onLog
  • Adds throwOnCameraPermissionDenied

    • Added a new optional throwOnCameraPermissionDenied boolean prop to renderCaptureId, renderCaptureFace, and renderAuthFace. When enabled, the SDK immediately calls onError with a PERMISSION_DENIED error code instead of showing the built-in denied/learn-more permission screens.

    This gives integrators full control over the camera permission denied UX, allowing them to handle the error in their own application layer.

    Affected render functions

    • renderCaptureId
    • renderCaptureFace
    • renderAuthFace

    Usage

    incode.renderCaptureId(container, {
      session,
      captureConfig,
      onSuccess: handleSuccess,
      onError: handleError,
      throwOnCameraPermissionDenied: true,
    });
    
    incode.renderCaptureFace(container, {
      session,
      captureConfig,
      onSuccess: handleSuccess,
      onError: handleError,
      throwOnCameraPermissionDenied: true,
    });
    
    incode.renderAuthFace(container, {
      session,
      authHint,
      onSuccess: handleSuccess,
      onError: handleError,
      throwOnCameraPermissionDenied: true,
    });
    

    Error shape

    When camera permission is denied and throwOnCameraPermissionDenied is set, the onError callback receives:

    {
      code: 'PERMISSION_DENIED',
      message: 'Error in permissions',
      error: Error('PERMISSION_DENIED')
    }
    

    Default behavior

    When throwOnCameraPermissionDenied is not set (default false), the SDK continues to show the built-in permission denied and learn-more screens as before. No breaking changes.

  • Improved document capture logging consistency and expanded support for passport document detection

Fixed

  • Update swiper dependency and remove unused jspdf dependency
  • Move Sardine updateConfig to fire on screen change instead of module change

1.87.0

11 February 2026

1.87.0

Added

  • Sentry Analytics (might require activation, please request to CS/SE)

Fixed

  • Unable to retry selfie capture after failed attempt on V1 when deepsight enabled
  • Low quality conditions shown instead of remove hat/lens/mask
  • Move resources to vanity CDN -> cdn.incodesmlite.com

Download 1.87.0

1.86.1

16 January 2026

1.86.1

Fixed

  • Fixed types

Download 1.86.1

1.86.0

24 December 2025

1.86.0

Added

  • When E2EE is enabled in Deepsight, videos are correctly encrypted
  • Added face occlusion error for Selfie on both V1 and V2

Fixed

  • Issue where sometime ID module failed when BackID was enabled
  • Sometimes fail screen is visible before the onError function is called
  • Fixed layout for data entry on forms
  • Remaining attempts showing correctly when capturing ID
  • Execute face checks correctly on VS
  • Fixed time for capturing on selfie
  • CaptureID sometimes incorrectly detected borders of IDs
  • Sardine Risk now updates on each module
  • Fixed high risk vulnerabilities on SDK

Download 1.86.0

1.85.0

21 November 2025

1.85.0

Added

  • Recordings added to CaptureOnly when enableIdRecording enabled
  • Tutorial can be skipped on document capture with showTutorial:false
  • Phone and Email hint support
  • Added processFinanceSettlement to renderCamera("document") method
  • Close button can be hidden with hideHeaderBranding on uiConfig

Fixed

  • Autocapture timeout resets when module is closed
  • RenderAuthFace crashing on second attempt
  • Attempts counter on Selfie Capture v2
  • Preview showing correctly on autocapture for ID v2
  • Close buttons working on tutorial
  • Moving to landscape/portrait on iPad no longer breaks layout
  • sendFingerprint correctly sends cached information even when called multiple times

Download 1.85.0

1.84.0

10 October 2025

1.84.0

Added

  • New renderAuthFace module for identity verification, this uses v2
  • New executeFlow module to provide a flow ID and execute from start to end without extra configuration
  • Added captureOnly mode for v2, supporting deepsight NOTE: Deepsight must be enabled and access to deepsight blobs might need to be requested.
  • Implement DMV scan and support to scan back -> front
  • Improved loading times for camera

Fixed

  • Selfie checks are performed on renderLogin
  • Better rendering for tablets
  • Fixed small issues on Signature Screen
  • Blank screens when switching apps
  • Support for horizontal mode on Ipad

Download 1.84.0

1.83.1

30 October 2025

1.83.1

Fixed

  • OTP screen cleans correctly after failed attempt and doesn't flash anymore

Download 1.83.1