> ## Documentation Index
> Fetch the complete documentation index at: https://docs-api.kravata.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Mobile SDK overview

> Embed the Kravata financial widget in your Flutter or React Native app and connect it to your Kravata Stack API integration.

The Kravata Mobile SDK opens the Kravata financial widget as a full-screen view inside your app. The widget handles device authentication, one-time passwords (TOTP) and the user session for you. Your backend keeps doing what it does with the [Kravata Stack API](/stack/overview): it authenticates, receives webhooks and registers your users with their KYC data.

<CardGroup cols={2}>
  <Card title="Flutter" icon="mobile" href="/sdk/flutter">
    Add `kravata_sdk_plugin` and open `KravataWebView`.
  </Card>

  <Card title="React Native" icon="react" href="/sdk/react-native">
    Add `kravata-sdk-plugin` and render `KravataWidgetComponent`.
  </Card>
</CardGroup>

## How the SDK connects to the Stack API

An SDK integration has three parts. The first one runs in your app; the other two run in your backend against the Stack API.

<Steps>
  <Step title="Open the widget from your app">
    Your app asks your backend for a widget session (`sharedKey`, `nonce`, `clientId`) and opens the widget with your own ID for the user as `userId`. See [Flutter](/sdk/flutter) or [React Native](/sdk/react-native).
  </Step>

  <Step title="Receive the terms acceptance webhook">
    When the user accepts the Terms and Conditions in the widget, Kravata sends the `user.accepted_terms` event to your backend. Your `userId` comes back in that event. See [Backend integration](/sdk/backend#2-receive-the-terms-acceptance-webhook).
  </Step>

  <Step title="Register the user with their KYC data">
    Your backend calls [User Registration](/stack/api-reference/users/user-registration) with the user's data and the **same** ID you passed as `userId`. Kravata runs the KYC review and notifies you with `user.updated`. See [Backend integration](/sdk/backend#3-register-the-user).
  </Step>
</Steps>

```mermaid theme={"dark"}
sequenceDiagram
    autonumber
    participant App as Your app
    participant BE as Your backend
    participant SDK as Kravata widget
    participant K as Kravata Stack API
    App->>BE: Request a widget session
    BE-->>App: sharedKey, nonce, clientId
    App->>SDK: Open widget (userId = your user ID)
    SDK->>K: Device and session authentication
    Note over SDK,K: The user accepts the Terms and Conditions
    K->>BE: Webhook user.accepted_terms { user_id }
    BE->>K: POST /api/v1/users/register (same user ID)
    K->>BE: Webhook user.updated (status APPROVED / REJECTED)
```

<Info>
  The ID you pass to the SDK as `userId` is the thread that ties everything together. Use a stable ID from your system (a UUID v4 is recommended) and send the same value when you register the user. Kravata stores it in the user's metadata as `EXTERNAL_USER_ID`.
</Info>

## Environments

The SDK picks the Kravata environment from the `environment` parameter. Your backend calls the Stack API host of the same environment.

| Environment | SDK value | Stack API base URL for your backend |
| - | - | - |
| Test | `test` | `https://test-api-kore.kravata.co` |
| Production | `prod` | `https://partners-api.kravata.co` (mTLS and IP allowlist, see [Authentication](/stack/authentication#production-access-mtls-and-ip-allowlist)) |

## Credentials

Kravata gives you an independent set of credentials for each environment. Test and production credentials are different: never use production credentials while developing.

| Credential | What it is for | Where it lives |
| - | - | - |
| `tenant` | Name of the tenant assigned to your company. It selects your branded widget. | App (it is not a secret) |
| `sharedKey` | Authenticates the widget on behalf of your company. | Your backend, sent to the app per session |
| `clientId` | Unique ID of your company as a Kravata partner. | Your backend, sent to the app per session |
| GitHub token | Read access to the private SDK repository. | Your build configuration (`pubspec.yaml` or `package.json`) |
| `apiKey`, `secretKey` | Stack API access token. See [Authentication](/stack/authentication). | Your backend only |
| `x-integration-register` | Links User Registration to your field mapping. See [Users](/stack/users). | Your backend only |

<Warning>
  `sharedKey`, `clientId`, `apiKey` and `secretKey` are company credentials, not per-user values. Never hard-code them in your app: anyone can extract them by decompiling the APK or IPA. Your app must get `sharedKey` and `clientId` from your backend when it opens the widget.
</Warning>

To get your credentials or the SDK repository access, contact your Kravata point of contact and say which environment you need.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.