{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-docs/guides/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Same-Device Return"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"same-device-return","__idx":0},"children":["Same-Device Return"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When the holder starts a verification on their phone, in your web app or mobile site, the wallet can send them back to you once they have answered. You give the session a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uri"]},". After the holder presents, declines, or the presentation fails, the wallet shows a button back to you. The button opens your ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uri"]}," with a fresh ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["response_code"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["response_code"]}," also protects the result. A session created with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uri"]}," returns its disclosed ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["attributes"]}," only to a read that passes the code. The code reaches only the browser the wallet opened. So someone who started the verification and sent the wallet link to somebody else never gets that person's data."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This page builds on the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/guides/verification/flow"},"children":["Verification Flow"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"when-to-use-it","__idx":1},"children":["When to use it"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["The holder is on their phone"]},", in your web app or mobile site, and you open the session's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["deeplink"]}," there. This is the case the return is made for."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["The verified data is tied to an account or an action"]}," (onboarding, identity proofing, a purchase). Without the return, whoever holds the session id gets the result. That includes someone who started the session themselves and forwarded the deeplink or QR code to another person."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Without ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uri"]},", nothing changes: the wallet closes its flow, and the session reads as described in the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/guides/verification/flow"},"children":["Verification Flow"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"how-it-works","__idx":2},"children":["How it works"]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"sequenceDiagram\n participant B as Holder's browser\n participant P as Your backend\n participant D as DeepCredentials\n participant W as Wallet\n B->>P: Start verification\n P->>D: POST /verification-sessions (redirect_uri)\n D-->>P: session_id, deeplink\n P->>P: Remember session_id (see \"Checking on your side\")\n P-->>B: Open deeplink\n B->>W: Wallet opens\n W->>D: Presentation (or decline)\n D-->>W: redirect_uri?response_code=…\n W->>B: Holder taps \"back to you\"\n B->>P: redirect_uri?response_code=…\n P->>D: GET /verification-sessions/{session_id}?response_code=…\n D-->>P: Session with attributes\n P-->>B: Continue\n","diagramHtml":"WalletDeepCredentialsYour backendHolder's browserWalletDeepCredentialsYour backendHolder's browserStart verificationPOST /verification-sessions (redirect_uri)session_id, deeplinkRemember session_id (see \"Checking on your side\")Open deeplinkWallet opensPresentation (or decline)redirect_uri?response_code=…Holder taps \"back to you\"redirect_uri?response_code=…GET /verification-sessions/{session_id}?response_code=…Session with attributesContinue","diagramHtmlDark":"WalletDeepCredentialsYour backendHolder's browserWalletDeepCredentialsYour backendHolder's browserStart verificationPOST /verification-sessions (redirect_uri)session_id, deeplinkRemember session_id (see \"Checking on your side\")Open deeplinkWallet opensPresentation (or decline)redirect_uri?response_code=…Holder taps \"back to you\"redirect_uri?response_code=…GET /verification-sessions/{session_id}?response_code=…Session with attributesContinue"},"children":["sequenceDiagram\n participant B as Holder's browser\n participant P as Your backend\n participant D as DeepCredentials\n participant W as Wallet\n B->>P: Start verification\n P->>D: POST /verification-sessions (redirect_uri)\n D-->>P: session_id, deeplink\n P->>P: Remember session_id (see \"Checking on your side\")\n P-->>B: Open deeplink\n B->>W: Wallet opens\n W->>D: Presentation (or decline)\n D-->>W: redirect_uri?response_code=…\n W->>B: Holder taps \"back to you\"\n B->>P: redirect_uri?response_code=…\n P->>D: GET /verification-sessions/{session_id}?response_code=…\n D-->>P: Session with attributes\n P-->>B: Continue\n"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-1-create-the-session-with-redirect_uri","__idx":3},"children":["Step 1: Create the session with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uri"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Both session endpoints take ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uri"]},": ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST /b2b/v1/verification-sessions"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST /b2b/v1/verification-cases/{caseId}/sessions"]},"."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n \"credential_definition_id\": \"YOUR_CREDENTIAL_DEFINITION_ID\",\n \"redirect_uri\": \"https://app.example.com/verify/return\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The URI must be absolute ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https"]},", with no fragment and no ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["response_code"]}," parameter of its own. Anything else is ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["400 invalid_argument"]},". It may carry its own query parameters. The session echoes it as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uri"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Your return page will need the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["session_id"]}," to read the result. Where you keep it depends on what the result is for. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#checking-on-your-side"},"children":["Checking on your side"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-2-the-holder-comes-back","__idx":4},"children":["Step 2: The holder comes back"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After the holder answers, the wallet offers a button back to you. The button opens:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"https://app.example.com/verify/return?response_code=K3x0…\n"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The wallet opens it in the phone's default browser. That is usually the browser the holder started in, but it can be a new tab or, on Android, another browser."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The return happens after a decline or a failed check as well, so your page should expect any outcome."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-3-read-the-result-with-the-code","__idx":5},"children":["Step 3: Read the result with the code"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["On your return page:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Take ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["response_code"]}," from the URL, and remove it from the address bar (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["history.replaceState"]},"). It is single-purpose."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Send it to your backend. Your backend finds the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["session_id"]}," (see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#checking-on-your-side"},"children":["Checking on your side"]},") and reads:"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"GET /b2b/v1/verification-sessions/{sessionId}?response_code=K3x0…\n"},"children":[]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Read"},"children":["Read"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Answer"},"children":["Answer"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["With the right code"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The full session, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["attributes"]}," included."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Without a code"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The full session, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["attributes"]}," left out and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["attributes_withheld: true"]},". Status, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["error_code"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["credential_status"]}," and the rest are there."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["With a wrong or expired code"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["403 permission_denied"]},"."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The code is valid for ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["30 minutes"]}," after the wallet answered. Read the result when the holder returns, and store what you need. After 30 minutes the session's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["attributes"]}," can no longer be read."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["We do not invalidate the code when you read with it, so a retry after a network error works. ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Use it once yourself"]},": see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#use-the-code-once"},"children":["Use the code once"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"checking-on-your-side","__idx":6},"children":["Checking on your side"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The flow is:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The wallet opens ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uri?response_code=C"]},", so the code is in the query of the holder's browser."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Your return page takes ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["C"]}," and gives it to your backend."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Your backend calls ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GET /b2b/v1/verification-sessions/{sessionId}?response_code=C"]},". ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["200"]}," with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["attributes"]}," means the code belongs to that session, and the person continues. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["403"]}," means it does not, and the person does not continue."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The code is created when the wallet answers, and only the wallet gets it: not you, not whoever created the session. So holding the code proves one thing: ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["this browser was opened by the wallet of the person who just verified."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Whether that is enough depends on what you do with the result."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"model-1-the-result-goes-to-whoever-brings-the-code","__idx":7},"children":["Model 1: the result goes to whoever brings the code"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The verification is the start of something new: an application, an order, a sign-up. Nothing exists yet that the result must attach to. Give the result to the browser that brings the code, whichever browser it is."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The return page needs to know which session it is, and the browser it arrives in may not be the one that started. The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uri"]}," is fixed when you create the session, before you have its ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["session_id"]},", so put ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["your own reference"]}," in it (an order or application id) and map it to the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["session_id"]}," on your side. Your reference may be in the URL: without the code, it reads no data."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"on start:\n ref = new application id\n V = POST /b2b/v1/verification-sessions { ..., redirect_uri: \".../verify/return?ref={ref}\" }\n store ref → V\n\non GET /verify/return?ref=R&response_code=C:\n V = lookup R\n if V is none or already used: show \"start again\"; stop\n session = GET /b2b/v1/verification-sessions/{V}?response_code=C\n if 403: show \"this link no longer works, start again\"; stop\n mark V used // the code is used once\n continue this browser's flow with session.attributes\n"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Someone who created the session and forwarded the QR code or deeplink to somebody else gets nothing: the code went to the other person's browser."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"model-2-the-result-attaches-to-something-that-existed-before","__idx":8},"children":["Model 2: the result attaches to something that existed before"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The person is signed in to your service, and the verification confirms the identity ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["of that account"]},". Here the code alone is not enough. The attack:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["An attacker signs in to their own account and starts a verification."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["They forward the deeplink or QR code to a victim, who presents their credential."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The wallet opens the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["victim's"]}," browser with a valid code."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["If you accept the code in any browser and attach the result to the account that started the session, the victim's identity ends up on the attacker's account."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The code is genuine: it came from the person who verified, just not to the place it should go. So check that the code arrives ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["in the same signed-in session that started the verification"]},":"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"on start (signed-in session S):\n V = POST /b2b/v1/verification-sessions { ..., redirect_uri: \".../verify/return\" }\n S.pending_verification = V // server-side, not in the URL\n\non GET /verify/return?response_code=C (session S of this request):\n V = S.pending_verification\n if V is none: show \"start the verification again in this browser\"; stop\n session = GET /b2b/v1/verification-sessions/{V}?response_code=C\n if 403: refuse; stop\n S.pending_verification = none // the code is used once\n attach session.attributes to S's account\n"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In the attack, the victim's browser has no session of the attacker, so nothing is attached. The attacker's session has ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["V"]}," but no code, and a read without it returns no ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["attributes"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The price: the wallet opens the phone's default browser. If the person started in another browser, they have no session there and must start again in that browser."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"use-the-code-once","__idx":9},"children":["Use the code once"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["We do not invalidate the code when you read with it, so a retry after a network error still works. Invalidate it yourself. Once a code has opened a result, do not accept it again: the URL that carried it can end up in browser history, proxy logs or error reports."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"why-the-code-is-not-in-the-api-response","__idx":10},"children":["Why the code is not in the API response"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The code reaches you only through your ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uri"]},", never in a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GET"]}," response or a webhook, and the session's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["attributes"]}," come only with it. Had we returned the code to your backend, you would receive the data in any case, and comparing codes would be up to you. An integration that forgot to compare would work exactly the same and have no protection. With the code as the key to the data, there is no way to get the result without the code from the browser the wallet opened. This is the OpenID4VP model (§13.3): the verifier's frontend passes the response code to fetch the wallet's answer."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-else-changes-for-a-session-with-redirect_uri","__idx":11},"children":["What else changes for a session with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uri"]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["The list never returns its values."]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GET /b2b/v1/verification-sessions"]}," leaves out ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["attributes"]}," for such sessions and sets ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["attributes_withheld: true"]},". Read them one session at a time, with the code."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["The webhook is unchanged."]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["verification.completed"]}," carries the session id, status and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["credential_status"]},", never disclosed data. Use it to learn that the holder answered, then read the result with the code once they are back."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Sessions without ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uri"]}," are unchanged"]},", including those created before this existed."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"when-the-holder-scanned-a-qr-code","__idx":12},"children":["When the holder scanned a QR code"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If the holder scanned a QR code shown on a computer, the wallet's button opens your ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uri"]}," ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["on the phone"]},", not on the computer. The code reaches the phone's browser. The computer's browser session holds the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["session_id"]}," but never the code, so it cannot read the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["attributes"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Plan for that. Either have the holder continue on the phone, or create sessions for the QR code on a computer without ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uri"]},". Without ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uri"]}," the session reads as before, but it is not protected against a forwarded QR code. That limit is OpenID4VP's own: binding the result to a browser needs the wallet and the browser on one device."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"error-handling","__idx":13},"children":["Error handling"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Case"},"children":["Case"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Answer"},"children":["Answer"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uri"]}," not absolute ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https"]},", with a fragment, or with a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["response_code"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["400 invalid_argument"]}," at creation"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Read with a wrong or expired ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["response_code"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["403 permission_denied"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Read without ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["response_code"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["200"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["attributes"]}," left out, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["attributes_withheld: true"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/guides/error-handling"},"children":["Error Handling"]}," for the error format."]}]},"headings":[{"value":"Same-Device Return","id":"same-device-return","depth":1},{"value":"When to use it","id":"when-to-use-it","depth":2},{"value":"How it works","id":"how-it-works","depth":2},{"value":"Step 1: Create the session with redirect_uri","id":"step-1-create-the-session-with-redirect_uri","depth":2},{"value":"Step 2: The holder comes back","id":"step-2-the-holder-comes-back","depth":2},{"value":"Step 3: Read the result with the code","id":"step-3-read-the-result-with-the-code","depth":2},{"value":"Checking on your side","id":"checking-on-your-side","depth":2},{"value":"Model 1: the result goes to whoever brings the code","id":"model-1-the-result-goes-to-whoever-brings-the-code","depth":3},{"value":"Model 2: the result attaches to something that existed before","id":"model-2-the-result-attaches-to-something-that-existed-before","depth":3},{"value":"Use the code once","id":"use-the-code-once","depth":3},{"value":"Why the code is not in the API response","id":"why-the-code-is-not-in-the-api-response","depth":3},{"value":"What else changes for a session with redirect_uri","id":"what-else-changes-for-a-session-with-redirect_uri","depth":2},{"value":"When the holder scanned a QR code","id":"when-the-holder-scanned-a-qr-code","depth":2},{"value":"Error handling","id":"error-handling","depth":2}],"frontmatter":{"seo":{"title":"Same-Device Return"}},"lastModified":"2026-10-21T09:09:47.194Z","pagePropGetterError":{"message":"","name":""}},"slug":"/docs/guides/verification/same-device","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}