Skip to main content
The Kravata Mobile SDK opens the Kravata financial widget as a full-screen view inside your app. The widget handles device authentication, one-time passwords (TOTP) and the user session for you. Your backend keeps doing what it does with the Kravata Stack API: it authenticates, receives webhooks and registers your users with their KYC data.

Flutter

Add kravata_sdk_plugin and open KravataWebView.

React Native

Add kravata-sdk-plugin and render KravataWidgetComponent.

​
How the SDK connects to the Stack API

An SDK integration has three parts. The first one runs in your app; the other two run in your backend against the Stack API.
1

Open the widget from your app

Your app asks your backend for a widget session (sharedKey, nonce, clientId) and opens the widget with your own ID for the user as userId. See Flutter or React Native.
2

Receive the terms acceptance webhook

When the user accepts the Terms and Conditions in the widget, Kravata sends the user.accepted_terms event to your backend. Your userId comes back in that event. See Backend integration.
3

Register the user with their KYC data

Your backend calls User Registration with the user’s data and the same ID you passed as userId. Kravata runs the KYC review and notifies you with user.updated. See Backend integration.
The ID you pass to the SDK as userId is the thread that ties everything together. Use a stable ID from your system (a UUID v4 is recommended) and send the same value when you register the user. Kravata stores it in the user’s metadata as EXTERNAL_USER_ID.

​
Environments

The SDK picks the Kravata environment from the environment parameter. Your backend calls the Stack API host of the same environment.

​
Credentials

Kravata gives you an independent set of credentials for each environment. Test and production credentials are different: never use production credentials while developing.
sharedKey, clientId, apiKey and secretKey are company credentials, not per-user values. Never hard-code them in your app: anyone can extract them by decompiling the APK or IPA. Your app must get sharedKey and clientId from your backend when it opens the widget.
To get your credentials or the SDK repository access, contact your Kravata point of contact and say which environment you need.