# Third-Party Dependencies

:::note
This guide is specific to Web SDK 2.0. If you are still using 1.x, you can find documentation [here](/sdk-reference/web-sdk-reference).  Contact your Incode Representative for upgrade information and check if you are a candidate for this upgrade. <br /><br />Full rollout to all clients still TBD.
:::

The Incode Web SDK loads some resources from domains outside your configured `apiURL`. This page lists those external network requests — what they're for, and how to remove, replace, or self-host them. Use it to configure Content-Security-Policy allowlists or to run a fully self-hosted deployment.

## Summary

| Resource         | Domain                | Package            | Default                    | Override                                                         |
| ---------------- | ---------------------- | ------------------- | --------------------------- | ------------------------------------------------------------------ |
| WASM + ML models | `cdn.incodesmile.com` | `@incodetech/core` | Loaded when `wasm` is set  | `setup({ wasm: { wasmPath, modelsBasePath, ... } })`             |
| Public IP lookup | `api.ipify.org`       | `@incodetech/core` | Enabled                    | `setup({ ipLookup: false })`                                     |
| Translations     | `api.i18nexus.com`    | `@incodetech/web`  | Runtime fetch per language | `setup({ i18n: { loadPath \| skipRemoteLoad, translations } })` |

Fonts and animations are bundled in `@incodetech/web` — they don't hit third-party domains and aren't listed here.

`@incodetech/web`'s `setup()` forwards `ipLookup` and `fingerprint` to `@incodetech/core` and applies `i18n` internally.

## WASM / ML models

**What:** WASM binaries, glue JavaScript, and ML models for face and ID capture.

**Default domain:** `cdn.incodesmile.com`

Override individual paths, or point at your own host entirely:

```ts
import { setup } from '@incodetech/core';

await setup({
  apiURL: 'https://api.incode.com',
  wasm: {
    wasmPath: '/wasm/webLib.wasm',
    glueCodePath: '/wasm/webLib.js',
    modelsBasePath: '/wasm/models',
  },
});
```

See [WASM Configuration](/sdk-reference/web-sdk-2-wasm/) for the full self-hosting walkthrough, including required headers and SIMD variants.

## Public IP lookup (ipify)

**What:** Fetches the client's public IP address, used to enrich the device-fingerprint submission.

**Default domain:** `api.ipify.org`

```ts
import { setup } from '@incodetech/core';

await setup({
  apiURL: 'https://api.incode.com',
  ipLookup: false,
});
```

Set `ipLookup: false` to skip the third-party call entirely — useful for deployments where outbound calls to third-party services are restricted. See the `ipLookup` and `fingerprint` options in [API Reference](/sdk-reference/web-sdk-2-reference/) for the full behavior, including what each flag does to fingerprint submission.

## Translations (i18nexus)

**What:** Runtime translation JSON for the SDK's built-in UI strings.

**Default domain:** `api.i18nexus.com`

Serve translations from your own host, or bundle them at build time with no runtime fetch at all. See [Internationalization](/sdk-reference/web-sdk-2-i18n/#custom-translations) for both approaches (`loadPath` and `skipRemoteLoad`).

## API-driven externals (not SDK-configured)

These URLs come from Incode API responses, not hardcoded SDK constants, so they aren't controlled by a `setup()` option:

- Theme / logo assets
- Presigned upload URLs (electronic signature document uploads)
- Signed PDF document URLs
- Flow redirect URLs (desktop → mobile handoff)
- Recording-session WebSocket host (when video recording is enabled)

Configure these in your Incode Dashboard or with your Incode account team.

## Navigation-only links

Some modules link to Incode policy pages (for example, terms-of-service or privacy-policy links in consent screens). These are user-initiated navigation, not requests the SDK makes on its own.

## See Also

- [WASM Configuration](/sdk-reference/web-sdk-2-wasm/): self-hosting WASM and ML models
- [Internationalization](/sdk-reference/web-sdk-2-i18n/): self-hosting or bundling translations
- [API Reference](/sdk-reference/web-sdk-2-reference/): the full `setup()` options reference
- [End-to-End Encryption](/sdk-reference/web-sdk-2-e2ee/): routing SDK traffic through your own dedicated host