Skip to content

Restricted pilot. The API reference is generated from the running API. Successful matches return manual_review until attack detection is validated.

Mobile capture

The app captures and uploads. Your backend does everything else, because anything inside an app can be extracted.

  • Your app asks your backend to start a check.
  • Your backend creates a capture session and returns capture_token, upload_url and policy.
  • The app captures frames with the live camera and uploads them.
  • The app tells your backend it has finished, and your backend calls verify.
expo-upload.tsx
const form = new FormData();
form.append("frame", { uri: photo.uri, name: "frame.jpg", type: "image/jpeg" });
await fetch(session.upload_url, {
  method: "POST",
  headers: { Authorization: `Capture ${session.capture_token}` },
  body: form,
});

A rooted phone or modified app can inject a video stream into the camera path. Warka's checks raise the cost of common attacks, and they don't remove this risk.

Native Android and iOS snippets are in examples/mobile in the repository.

NextFace quality