User uploads document → Your server → KYC API → Queue → AI/Manual review
                                                            ↓
                                              Result (minutes to days)
                                                            ↓
                                              Webhook to your server

Your server generates QR → User scans with wallet → Wallet authenticates
                                                            ↓
                                              Cryptographic VP sent back
                                                            ↓
                                              Result (2-5 seconds)

// 1. Create verification session
const session = await kycProvider.createSession({
  type: 'identity',
  country: 'DE',
  documentTypes: ['passport', 'id_card'],
  redirectUrl: 'https://yoursite.com/callback',
});

// 2. Redirect user to provider's hosted page
redirect(session.url);

// 3. Handle webhook (async — could be minutes or hours later)
app.post('/webhooks/kyc', async (req, res) => {
  const event = verifyWebhookSignature(req.body, secret);

  if (event.type === 'verification.completed') {
    const result = await kycProvider.getResult(event.verificationId);

    // You now have: full name, DOB, document images, selfie, address
    // All of this is PII that you must store, protect, and eventually delete
    await db.users.update({
      kycStatus: result.status,
      kycData: encrypt(result.extractedData), // GDPR: encrypted PII storage
      kycDocuments: result.documentImages, // GDPR: document retention policy
    });
  }

  res.sendStatus(200);
});

import { createVerifier } from '@openeudi/core';

const verifier = createVerifier({ mode: 'demo' });

// 1. Create verification session
app.post('/api/verify', async (req, res) => {
  const session = await verifier.createSession({
    attributes: ['age_over_18'],
  });
  res.json({ qrCode: session.qrCode, sessionId: session.sessionId });
});

// 2. SSE endpoint for real-time result (seconds, not hours)
app.get('/api/verify/:id/events', (req, res) => {
  res.setHeader('Content-Type', 'text/event-stream');
  const session = verifier.getSession(req.params.id);

  session.onVerified((result) => {
    // You receive: { ageOver18: true, sessionId: '...', verifiedAt: '...' }
    // No PII. No documents. No storage obligation.
    res.write(`data: ${JSON.stringify(result)}\n\n`);
    res.end();
  });
});

// Age verification: you get a boolean, not a birth date
{ attributes: ['age_over_18'] }
// Result: { ageOver18: true }

// Country compliance is handled by your merchant whitelist/blacklist
// configuration — not by requesting data from the user