Use the following notes as final implementation reminders when integrating the Sumsub WebSDK or MobileSDK.

Area	WebSDK	MobileSDK
KYC session request	The client application requests a KYC session from the client backend.	The mobile app requests a KYC session from the client backend.
Access token generation	The client backend generates the SDK access token.	The backend generates the applicant SDK access token.
SDK launch	The frontend launches Sumsub WebSDK using the access token.	The mobile app initializes the Sumsub MobileSDK using the access token.
Frontend or app events	The SDK may provide frontend events for user experience tracking.	The client must support token refresh or token expiration handling where applicable.
Final decision source	Final onboarding decisions must be based on Payblr-processed KYC results, not only SDK frontend events.	The final decision must be based on Payblr result processing.

SDK access tokens must be generated server-side.
SDK access tokens must not be generated or signed in the frontend or mobile application.
The access token should be tied to the applicant and verification level.
The access token should only be used to initialize the applicant’s SDK flow.
The client should treat the access token as temporary and support refreshing or requesting a new token when the token expires.