Your frontend calls your own backend. Your backend calls POST /widget/session with the client_token (kept server-side) and the user’s real IP in client_ip.
Save merchant_transaction_id — you use it everywhere downstream (polling, WebSocket, webhook).
Your backend returns the session parameters to the frontend (minus the client_token, which never leaves your server).For the full request and response field reference, see POST /widget/session.
Your frontend receives the session parameters from your backend and passes them directly to proofWidget.run(). No client_token is needed on the frontend.
<div id="proof-widget"></div><script src="https://widget.proof.community/widget.2.0.js"></script><script> // `session` comes from your own backend endpoint, not from Proof directly proofWidget.run({ widgetId: session.widget_id, host: document.getElementById("proof-widget"), address: session.address, signature: session.signature, initToken: session.init_token, initTokenType: session.init_token_type, merchantTransactionId: session.merchant_transaction_id, currency: session.currency, network: session.network, amount: session.amount, fixCurrency: session.fix_currency, fixNetwork: session.fix_network, fixAmount: session.fix_amount, fiatCurrency: session.fiat_currency, type: session.type, onStatusChange: function(data) { console.log("Widget status:", data.status); } });</script>
The widget renders inside #proof-widget. The user completes identity verification (first time) and payment inside the widget.