What does it mean to verify users inside a chat assistant?
More and more, users reach services through AI chat assistants. If your company builds its own chatbot or AI assistant, you can use Persona Inquiries to verify users’ identities during a conversation, without sending them out of the chat.
Use it when a user has to prove who they are before the assistant can act. For example, to open an account, view records, book a visit, move money, or get a prescription.
It uses features you may already have: the inline SDK, Device Handoff by QR code, short link, or email, App Clip, the native SDKs, and webhooks. You configure Inquiry Templates, Verification Checks, and consent screens the same way you usually do.
How it works
- Your app decides when to verify. This usually happens at sign-up or right before a sensitive action.
- The user captures their ID and selfie on the device with the best camera. On mobile, users capture with their phone’s camera. On desktop, users can switch to their phone by scanning a QR code or opening a link.
- The result comes back into the conversation. When the user finishes, Persona sends the result to your backend. Your backend tells the assistant whether the user is verified, and the chat continues from there.
The chat only learns whether the user is verified. Information collected for the verification, such as ID images and personal information, never goes to the model, and the decision never passes through the user’s browser.
Choose a setup
If your chat runs in your own mobile app, use App Clip as your first choice on supported iPhones. It gives users native capture from a link, with no SDK to integrate. Choose the Mobile SDKs when you want full control of verification inside your iOS or Android app.
For website chats and partner apps, choose App Clip on supported iPhones. Use Device Handoff for desktop users and a full browser tab for Android users. On Android, users can finish in the Persona Wallet app, which they install from Google Play, when you don’t integrate an SDK. The table shows each setup and the work on your side.
| Where the chat runs | Device | Recommended option | Who does the work | Fallback |
|---|---|---|---|---|
| Your own app | iPhone | App Clip link | You open the link from your app | Mobile SDK for full in-app control, then a secure in-app browser sheet |
| Your own app | Android | Mobile SDK | You integrate the SDK into your app | Persona Wallet app or a secure in-app browser sheet (Chrome Custom Tab) |
| Your website | Desktop | Phone handoff with a QR code, short link, or email | You show the QR code or link in the chat | Webcam inside the page, only if every embedded layer allows camera access |
| Your website | iPhone browser | App Clip link | You add the link | Persona in a full browser tab |
| Your website | Android browser | Persona in a full browser tab, then back to the chat | You add the link | Persona in the page, only if camera access is allowed |
| A partner’s app | iPhone | App Clip, depending on how the partner’s app opens links | Mostly you, if the partner’s app lets links open | Persona in a full browser tab |
| A partner’s app | Android | Hand off to a browser tab | The partner may need to let links open outside its app | A native SDK, which the partner must build |
A mobile SDK in a partner’s app requires the partner to integrate it. If the partner supports that work, prefer the SDK over the link-based options.
Limits to plan for
- App Clip requires iOS 17.6 or newer. Users on older iPhones fall back to a full browser tab, so support both.
- In-app browsers can misbehave. Some apps open links in their own built-in browser, which can keep the App Clip from opening or break the selfie step. If your chat runs inside a partner’s app, test how that app opens links before launch.
- A chat inside a partner’s app on Android depends on the partner letting links open outside its app. Treat this as the least reliable path.
- We don’t recommend camera capture inside the chat window, with no handoff, as the main path. A chat window is often an iframe inside another iframe, and every layer must allow camera access. This is a frequent problem on iOS Safari. Use camera capture in the chat window only as the desktop fallback in the table, when every embedded layer allows camera access.
How do you set it up?
- Decide where your app starts verification, such as new user sign-up or before a sensitive action.
- Choose your setup. In your own app, use App Clip on supported iPhones, or a mobile SDK for full in-app control. Otherwise, choose the matching handoff or browser option in the table.
- Create an Inquiry from your backend with the Inquiry Template you already use. See Creating an Inquiry for the API creation method.
- Follow the guide for your setup. For App Clip, follow the native mobile app verification guide. For a mobile SDK, follow the Mobile SDK integration guide. For web handoff, see the Device Handoff component.
- If you load Persona in the chat window, make sure your page’s Permissions-Policy header allows Persona to use the camera. You can also limit which sites can load your flow by adding them to the Allowed Domains in the template’s Security settings, or for your whole organization in the Domain Manager. Add each subdomain separately. For the web setup, see the Inlined flow guide and Embedded flow security.
- Set up a webhook so your backend receives the result from Persona when the user finishes.
- Configure your backend to check the result, then update the chat and tell the assistant whether the user is verified. Don’t use a client completion event as the verification result.
- Handle the cancelled and error events so the user doesn’t get stuck.
- Start verification from your app’s chat when it’s required. Show the App Clip link, start the mobile SDK flow, or show the Device Handoff QR code or browser link.
- Test the full flow on the real page where the chat runs, in each browser and on each device you support.
What to check when it doesn’t work
- Persona doesn’t load in the chat. If you use Allowed Domains, check that the list includes every site and subdomain above the chat. Check that your page security settings allow Persona to load. The inline guide recommends a space at least 400 pixels wide and 650 pixels high, so a small chat card can be too small.
- The camera fails inside the page. Check that the Permissions-Policy header on every page that frames the chat allows Persona to use the camera. If it still fails, move capture out of the chat window. In your own app, use App Clip on a supported iPhone or a mobile SDK. Otherwise, use phone handoff from desktop or a full browser tab.
- The chat doesn’t update after the user finishes on their phone. Check that your webhook is set up and reaching your backend, and that your backend sends the update to the chat when the result arrives.
- The user gets stuck after cancelling or hitting an error. Check that your page handles the cancelled and error events and gives the user a way to try again.
- The App Clip doesn’t open on an iPhone. Check the iOS version. App Clip needs iOS 17.6 or newer, so older devices should get the full browser tab instead.
- The link doesn’t open as expected inside a partner’s app. The partner’s in-app browser may be handling the link. Test on real devices and see the limits above.
To learn more or request access, let us know. We're happy to help.