Third-Party Dependencies

Note

This guide is specific to Web SDK 2.0. If you are still using 1.x, you can find documentation here. Contact your Incode Representative for upgrade information and check if you are a candidate for this upgrade.

Full rollout to all clients still TBD.

The Incode Web SDK loads some resources from domains outside your configured apiURL. This page lists those external network requests — what they're for, and how to remove, replace, or self-host them. Use it to configure Content-Security-Policy allowlists or to run a fully self-hosted deployment.

Summary

Resource	Domain	Package	Default	Override
WASM + ML models	`cdn.incodesmile.com`	`@incodetech/core`	Loaded when `wasm` is set	`setup({ wasm: { wasmPath, modelsBasePath, ... } })`
Public IP lookup	`api.ipify.org`	`@incodetech/core`	Enabled	`setup({ ipLookup: false })`
Translations	`api.i18nexus.com`	`@incodetech/web`	Runtime fetch per language	`setup({ i18n: { loadPath \| skipRemoteLoad, translations } })`
Feature management	Statsig-managed endpoints	internal layer	Enabled	`setup({ featureManagement: false })`

Fonts and animations are bundled in @incodetech/web — they don't hit third-party domains and aren't listed here.

@incodetech/web's setup() forwards ipLookup, fingerprint, featureManagement, and environment to @incodetech/core, and applies i18n internally.

WASM / ML models

What: WASM binaries, glue JavaScript, and ML models for face and ID capture.

Default domain: cdn.incodesmile.com

Override individual paths, or point at your own host entirely:

import { setup } from '@incodetech/core';

await setup({
  apiURL: 'https://api.incode.com',
  wasm: {
    wasmPath: '/wasm/webLib.wasm',
    glueCodePath: '/wasm/webLib.js',
    modelsBasePath: '/wasm/models',
  },
});

See WASM Configuration for the full self-hosting walkthrough, including required headers and SIMD variants.

Public IP lookup (ipify)

What: Fetches the client's public IP address, used to enrich the device-fingerprint submission.

Default domain: api.ipify.org

import { setup } from '@incodetech/core';

await setup({
  apiURL: 'https://api.incode.com',
  ipLookup: false,
});

Set ipLookup: false to skip the third-party call entirely — useful for deployments where outbound calls to third-party services are restricted. See the ipLookup and fingerprint options in API Reference for the full behavior, including what each flag does to fingerprint submission.

Translations (i18nexus)

What: Runtime translation JSON for the SDK's built-in UI strings.

Default domain: api.i18nexus.com

Serve translations from your own host, or bundle them at build time with no runtime fetch at all. See Internationalization for both approaches (loadPath and skipRemoteLoad).

Feature management (Statsig)

What: Decides feature-gate and experiment values for the session, so Incode can roll changes out progressively and run capture experiments. Served by Statsig via the @statsig/js-client package, loaded as a separate chunk during setup().

Default: enabled. This is the one entry on this page that is on by default and reaches a third party without you opting in, so review it before a privacy sign-off.

Domains: the client uses Statsig's own default endpoints. The SDK does not override or proxy them, and exposes no option to redirect them, so take the current hostnames from Statsig's CSP guidance when you build an allowlist.

Opt out completely:

import { setup } from '@incodetech/core';

await setup({
  apiURL: 'https://api.incode.com',
  featureManagement: false,
});

With featureManagement: false the chunk is never fetched and no feature-management request leaves the browser. Reads from @incodetech/core/feature-management keep working and resolve to their defaults, so opting out does not break code that checks a gate.

What identity is sent. No customer API key is involved. The integration generates its own anonymous identifier (a "StableID") and enriches it over the session with hashed session, flow, and workflow identifiers. Two privacy defaults are already conservative, and two flags tighten them further:

IP address and country are redacted by default before anything is sent. Use redactedUserInfo to redact more fields, or to send those two deliberately.
disableStableId: true stops the identifier being generated at all — the strongest control. Evaluations then resolve to control values until session identity arrives.
disablePersistence: true keeps identity in memory only, so it is never linkable across page loads.

See FeatureManagementSetupOptions for the full option table, and Feature management for the read API.

API-driven externals (not SDK-configured)

These URLs come from Incode API responses, not hardcoded SDK constants, so they aren't controlled by a setup() option:

Theme / logo assets
Presigned upload URLs (electronic signature document uploads)
Signed PDF document URLs
Flow redirect URLs (desktop → mobile handoff)
Recording-session WebSocket host (when video recording is enabled)

Configure these in your Incode Dashboard or with your Incode account team.

Some modules link to Incode policy pages (for example, terms-of-service or privacy-policy links in consent screens). These are user-initiated navigation, not requests the SDK makes on its own.