Skip to main content

Installation

Add the dependency and configure the package manager
Step 1 — Configure Content Security Policy (CSP)

The Web SDK uses Web Workers for security and performance. Add the following configuration to your CSP:

<meta
  http-equiv="Content-Security-Policy"
  content="
      script-src 'self' 'unsafe-eval' *.googleapis.com *.acesso.io *.unico.run *.unico.io *.unico.app *.sentry.io;
      worker-src 'self' blob:;
      child-src 'self' blob:;
      style-src 'self' 'unsafe-inline' *.googleapis.com *.acesso.io *.unico.run *.unico.io *.unico.app;
      font-src 'self' https://fonts.gstatic.com *.acesso.io *.unico.run *.unico.io *.unico.app;
      img-src 'self' data: blob: *.acesso.io *.unico.run *.unico.io *.unico.app;
      media-src 'self' data: *.acesso.io *.unico.run *.unico.io *.unico.app;
      script-src-elem 'self' 'unsafe-inline' blob: *.googleapis.com *.acesso.io *.unico.run *.unico.io *.unico.app;
      connect-src *.googleapis.com *.acesso.io *.unico.run *.unico.io *.unico.app *.sentry.io"
/>
warning

If your application has a CSP, this configuration is mandatory to ensure correct functioning of the SDK.

Why each directive is required
  • 'unsafe-eval' (script-src) — required by the liveness detection engine to compile WebAssembly and dynamically evaluate its security routines at runtime.
  • 'unsafe-inline' (style-src, script-src-elem) — required by the SDK's inline styles and inline script bootstrapping. Removing it breaks the capture UI.
  • *.acesso.io — legacy Unico infrastructure domain, still load-bearing for assets and API calls.
  • *.unico.run / *.unico.io / *.unico.app — current Unico service domains (CDN, API, and app subdomains).
  • *.googleapis.com (script-src, style-src, script-src-elem, connect-src) — required to load the Google Fonts stylesheet (@font-face CSS via fonts.googleapis.com) and other Google API resources used by the capture UI.
  • fonts.gstatic.com (font-src) — serves the Google Fonts binary font files referenced by the stylesheet loaded from fonts.googleapis.com.
  • *.sentry.io — Unico uses Sentry for SDK error tracking. Required in script-src and connect-src to allow the error reporting calls.
  • blob: (worker-src, child-src, script-src-elem) — required because Web Workers and certain SDK sub-resources are created as Blob URLs at runtime.
Step 2 — Install the package

The Web SDK is provided through an npm package or CDN.

npm install unico-webframe
Step 3 — Import the SDK

After installing, import the SDK into your project.

import {
  UnicoCheckBuilder,
  SelfieCameraTypes,
  UnicoThemeBuilder,
  DocumentCameraTypes,
  UnicoConfig,
  LocaleTypes
} from 'unico-webframe'
Step 4 — Download additional resource files

Additional resource files are required to perform Liveness capture. Download the file matching your SDK version and include it in your project:

Upgrade checklist

The resource files are version-locked to the SDK. Every time you bump unico-webframe, you must re-download the matching resources from the table below — using mismatched versions causes a runtime error during liveness capture.

Alternatively, since SDK 3.18.0 the SDK can auto-fetch these files at initialization time, eliminating the manual download step. See Initialization for the setResourceDirectory option.

SDK versionFaceTec resources
3.23.79.7.114
3.23.3 → 3.23.69.7.107
3.23.0 → 3.23.19.7.102
3.22.6 → 3.22.79.7.100
3.22.59.7.99
3.22.3 → 3.22.49.7.98
3.22.29.7.96
3.22.19.7.93
3.22.09.7.90
3.21.3 → 3.21.49.7.85
3.21.29.7.82
3.21.19.7.80
3.20.10 → 3.21.09.7.76
3.20.99.7.75
3.20.89.7.73
3.20.79.7.68
3.20.5 → 3.20.69.7.65
3.20.3 → 3.20.49.7.64
3.20.29.7.63
3.20.19.7.61
3.20.09.7.55
3.19.0 → 3.19.39.7.45 → 9.7.51
3.18.x9.6.92 → 9.7.41 (see legacy table)

Also download the AI files for the SDK: models.zip.

Public path

All additional files must be hosted in a public location, visible to the Web within your project.

Last updated on