Confrmo on any website.
No WordPress required.

1 · What you need from Confrmo

Confrmo issues credentials for your organisation and registered domain: an App ID (ca_live_…) that identifies the registered application and an App Secret (sk_live_…) used by your server-side integration. Your App ID must be enabled for the services you use; Confrmo: It’s You requires view permission on your registered application.

2 · Kit contents

server/
  server.js              Same-origin security proxy
  package.json           Node dependencies and commands
  .env.example           Configuration template

web/
  index.html             Example landing page
  connect.html           Connect example
  its-you.html           It's You example
  success.html           Example post-login destination
  assets/                JavaScript and CSS

deployment/
  nginx-site.conf        Reverse-proxy example
  ecosystem.config.cjs   PM2 process definition

Verify your download against the published SHA-256 checksum.

3 · Install

Requirements: Node.js 20 or later, an HTTPS domain and nginx or an equivalent reverse proxy. Copy the kit to your server, then:

cd server
npm install --omit=dev
cp .env.example .env
nano .env

Set your configuration. Every value shown here is a placeholder; use the credentials issued for your domain.

PORT=3210
PUBLIC_ORIGIN=https://your-domain.example
CONFRMO_API_BASE=https://api.confrmo.com
CONFRMO_RENDER_BASE=https://api.confrmo.com
CONFRMO_CONNECT_SECRET=your_sk_live_secret
CONFRMO_APP_ID=your_ca_live_app_id
CONFRMO_APP_SECRET=your_sk_live_secret

Protect the file and start the service:

chmod 600 .env
npm start
curl -fsS http://127.0.0.1:3210/health

# Expected response:
{"ok":true,"service":"confrmo-web-integration"}

4 · Add the website files

The reference server serves the web folder directly. To incorporate the UI into an existing website:

1. Copy the required HTML from connect.html or its-you.html into your page.
2. Copy assets/site.css, or replace its presentation rules with your own styling.
3. Load assets/connect.js or assets/its-you.js at the end of the page.
4. Keep the same-origin /api/connect/* and /api/its-you/* routes supplied by server.js.

You may change layout, wording and styling. Do not move App credentials into the browser or call privileged Confrmo endpoints directly from browser JavaScript.

5 · Confrmo Connect flow

1. Browser calls POST /api/connect/start
2. Your server creates a Confrmo login session using the secret
3. Browser displays the returned VCode through the same-origin image proxy
4. Browser polls GET /api/connect/status/:token
5. The customer scans and approves in the Confrmo app
6. Your server consumes the approved session once and receives a pairwise userHandle
7. Your application maps that handle to its local customer account and creates its normal authenticated session

The example redirects to success.html. Replace this with your real session creation and authenticated destination.

6 · Confrmo: It’s You flow

1. Browser calls POST /api/its-you/session
2. Your server opens a viewing session using its protected application credentials
3. The customer scans the session VCode
4. The website requests one document type
5. The customer explicitly approves or declines in the app
6. On approval, your server claims the one-time view token and requests the render specification
7. The browser shows the temporary view
8. Either party ends the session; the view and parsed fields are immediately removed

Supported example document types: passport, licence, address, bank, utility.

7 · nginx and HTTPS

Edit deployment/nginx-site.conf, replacing customer.example with your domain and the port if required.

cp deployment/nginx-site.conf /etc/nginx/sites-available/confrmo-customer
ln -s /etc/nginx/sites-available/confrmo-customer /etc/nginx/sites-enabled/confrmo-customer
nginx -t
systemctl reload nginx
certbot --nginx -d customer.example

8 · Security requirements

• Serve the site over HTTPS only
• Keep secrets in a protected environment file or secret manager
• Use Cache-Control: no-store for session, approval and document responses
• Restrict API request body sizes and apply rate limiting
• Validate all session, grant and document identifiers
• Never log App Secrets, raw view tokens, document fields or identity data
• Consume Connect approvals once only
• Wipe the It’s You view and fields when a session ends
• Treat browser screenshot detection as a risk signal only, never guaranteed prevention
• Review your privacy policy and retention rules before production use

9 · Production account mapping

Connect returns a pairwise userHandle, not a password. Store it against the customer’s local account using a unique database constraint.

CREATE TABLE confrmo_identities (
  user_handle TEXT PRIMARY KEY,
  local_user_id TEXT NOT NULL,
  created_at TEXT NOT NULL
);

After successful consumption: find the local account mapped to the handle, apply your normal account status and fraud checks, create your normal secure login session, then redirect to the authenticated area.

10 · Acceptance test

Connect

• VCode appears
• Confrmo app recognises the registered organisation and domain
• Decline remains declined
• Approval signs in once
• Reusing the same approval fails
• Expired VCodes cannot be consumed

It’s You

• Session VCode appears
• App attaches to the correct organisation
• Each document requires explicit approval
• Decline does not reveal a document
• Approval shows the correct temporary view
• Ending from the app ends the website view
• Ending from the website ends the app session
• Refreshing does not restore a previous document

11 · Support information

When reporting an integration problem, provide: your registered domain, your App ID only (never the App Secret), the UTC time of the failure, the service involved (Connect or It’s You), the HTTP status and safe error code, and browser and server software versions.