From nothing to an enforced mandate

Quickstart

First decision: who writes the screen the person sees. Everything after it is the same rail, the same fields and the same receipts.

Pick an integration mode

Both modes hit the same endpoints and produce the same receipts, and you can mix them per flow. Compare them in full → 01

Create the session

One session does one thing. This one takes a mandate grant: the person sees what they are authorising, proves they are alive, and grants it on our screen — styled as yours.

Take the result from the webhook

The person comes back to your return_url with a session_id on the query string — treat that as a hint. The authoritative outcome is the webhook plus the session read.

Node

// POST /webhooks/sidaxis — signature verified first, always if (event.type === "session.completed") { const s = await sidaxisGet(`/sessions/${event.data.id}`); await saveMandate(s.result.mandate_id); // mnd_9f41c7b2 }

Signature verification, retries and ordering → 03

Check before the agent acts

From here the two modes are identical. One call before every action, and you branch on allowed , never on the HTTP status.

Point at the sandbox

The sandbox mirrors production with synthetic identities and forced failures. Sandbox keys start sk_test_ and never reach production data.

Shell

export SIDAXIS_API_KEY=sk_test_… export SIDAXIS_BASE=https://sandbox.api.sidaxis.com/v1

Claim the person once

The reading happens on the person's device; the SDK hands you a proof. Keep the facetoken — every later call refers to the person by it, and recognising them again is free.

Record what the human authorised

Five fields, all required: who granted, who may act, what may be done, up to how much, until when. The grant needs proof of a live human at the moment it is made — it cannot be created from a session that was already open.

Check before the agent acts

One call before every action. Branch on allowed , never on the HTTP status: a refusal is a 200 with a reason. Sidaxis does not move the money — your system or your PSP settles, or stops.

A refusal is the rail working Nothing in this flow is billed unless it completes, recognition is free at any volume, and a refused check consumes nothing. If your integration never sees an allowed: false , you have not tested it yet — force one in the sandbox. See also Authentication, versions and idempotency → Reference: does this action fit the mandate? → Run it as an MCP server instead →