Tencent Palm Mobile-Side (H5) API Documentation (v2.3.0)

This document applies to both the Max and Standard versions; the interface content is identical.

Version: v2.3.0

The Tencent Palm Mobile Manager Web SDK provides a complete solution for palm biometrics in the browser, supporting registration, verification, and recognition modes. It is the web port of the iOS/Android/Flutter PalmMobileManager native SDKs — Params / Result / Mode / PalmDirection / ResultCode map 1:1, so the same backend and business log pipeline can be reused directly. The camera and wasm capture are isolated inside a trusted independent origin via iframe + postMessage. The SDK is deployed on a dedicated SDK Host domain; host pages integrate with a single <script src> tag.

Core Modules

The SDK consists of two core modules: Management Module and Acquisition Module, whose behavior is aligned with the native SDKs.

Management Module

User Management Center, responsible for managing users' palm print information, e.g. the user registration flow and palm data management.

User Management — Automatically query/create users, display palm registration status (Registered / Not Registered / Pre-registered).
Business Flow — Supports three modes: Registration, Recognition (1:N), and Verification (1:1).
UI Interaction — Displays operation guidance, processing results, error prompts, and retry options.
Result Processing — Receives acquisition results and automatically reports recognition/verification records (Note: You must configure the scene's SN as PalmMobileManager on the Palm Application Platform admin console for record reporting to work).
Result Callback — Only calls back to your host page on critical errors (Token invalid, gateway authentication failed) or user exit.

Acquisition Module

Palm Information Acquisition, responsible for the capture and on-device algorithm pipeline, e.g. capturing the palm print and performing registration / verification / recognition:

Camera Acquisition — Uses navigator.mediaDevices.getUserMedia to launch the camera and provide a real-time preview.
AI Processing — Built-in algorithms for palm print detection, quality assessment, and liveness action recognition (WebAssembly inference).
Interactive Guidance — Guides the user through actions like "open palm" and "make fist".
Data Upload — Encrypts and uploads captured images to the server. Liveness video upload is mandatory (used as compliance/audit evidence); a missing or failed video surfaces as ErrLivenessVideoFailed / ErrNetwork rather than being swallowed.

Features

Multiple Modes — Supports Registration, Verification (1:1), and Recognition (1:N).
Optimized AI Algorithms — High-performance detection & alignment, liveness verification, quality control, and action recognition are integrated inside the SDK via WebAssembly.
Modular UI Components — Complete, pre-built Vue UI for both the management and acquisition modules, drastically shortening development time.
Origin Isolation — The acquisition UI and wasm run inside an iframe on an independent origin and communicate with the host page through postMessage with strict origin checks.
Secure by Design — All palm print data is automatically encrypted before being transmitted to the server.

Core Concepts

To better understand the acquisition results of this SDK and the differences vs. on-device usage, please be aware of the distinction between the following feature sets:

[Palm Print] Single-Factor Feature Set
- Description: Records only palm print single-factor information. Because browser cameras cannot capture palm vein data, this SDK only collects palm print single-factor information.
[Palm Print + Palm Vein] Dual-Factor Feature Set
- Description: Records both palm print and palm vein dual-factor information. This is the high-security standard used for enrollment on professional devices.

SDK Host

The SDK is deployed by the service provider on a dedicated domain (the SDK Host). Host pages integrate with a single <script src> tag pointing at the loader on that host. The capture iframe, wasm, and camera UI are all loaded and served automatically by the SDK Host — the host page does not need to know about their internals.

<SDK Host>/palm_h5/loader/palm-mobile-manager.js — the entry point your host page includes via <script src>
<SDK Host>/palm_h5/embed/ — the capture iframe page, auto-loaded (the loader infers this address itself; no manual configuration)

Important: The SDK Host MUST be on a different origin from your host page, so that MessageEvent.origin checks meaningfully secure cross-window communication. The loader and embed live on the same SDK Host; the loader auto-infers the embed address from its own <script src>, so the host page needs zero configuration.

Workflow

Note: If you only use the Acquisition Module (enableManager = false, users will not be automatically created via the Management Module), please have your server call the CreateUser API from Tencent PalmAI Platform OpenAPI to create users first, then proceed with the following steps.

1. Obtain User Token

Your backend server must first request an AccessToken bound to the user's UserId from Tencent PalmAI Platform OpenAPI.

Note: When calling the CreateAccessToken API, specify GrantType as client_credential_user and provide the UserId parameter.

- **Management Module**
Your Browser --[UserId]--> Your Server --[Call CreateAccessToken]--> Tencent PalmAI Platform
Your Browser <--[AccessToken]-- Your Server <--[AccessToken]-- Tencent PalmAI Platform

- **Acquisition Module**:
Your Browser --[UserId (unregistered)][UserName]--> Your Server --[Call CreateUser]--> Tencent PalmAI Platform
Your Browser --[UserId (registered)]--> Your Server --[Call CreateAccessToken]--> Tencent PalmAI Platform
Your Browser <--[AccessToken]-- Your Server <--[AccessToken]-- Tencent PalmAI Platform

2. Start the SDK

Our backend services are divided into two parts: the Palm Application Platform and the Palm Algorithm Platform. The SDK provides two corresponding modules to connect to them:

SDK Module	Backend	Description
Management Module	Palm Application Platform	Provides a complete palm print management UI. Enters from the management page, then jumps to the acquisition screen after UI interaction. The result is handled internally by the SDK.
Acquisition Module	Palm Algorithm Platform	Jumps directly to the camera acquisition screen for palm print capture and algorithm processing. You design the management page and handle the result yourself.

Choose the module that matches your business needs:

Management Module: Start with AccessToken and required user information (enableManager = true).
Acquisition Module: Start with AccessToken and required user information (enableManager = false).

3. Automated Flow

The Management Module automatically completes the following flow without your host page's intervention:

Query user registration status.
Display friendly UI and operation prompts.
Invoke the Acquisition Module based on mode (Registration / Recognition / Verification).
Receive and process various situations from the Acquisition Module (success, permission issues, network issues, algorithm results, etc.).
Prompt the user to retry or display the final result.

The Acquisition Module requires you to handle the result yourself. The code field corresponds to the result codes in this document.

4. Receive Callback

When the user clicks back or encounters a critical error, the Management Module dismisses the iframe and delivers the Result via Promise / callback. The Acquisition Module requires you to handle it yourself. Only one session is allowed at a time; concurrent start() calls are rejected immediately with ErrSdkRuntime (10007).

Runtime Requirements

To ensure the stability and compatibility of the SDK, please make sure your runtime environment meets the following minimum requirements:

Item	Requirement
Protocol	HTTPS (`localhost` is exempted). Browser `getUserMedia` requires a secure context.
Browser	● Desktop: Chrome / Edge ≥ 88, Firefox ≥ 90, Safari ≥ 14 ● Mobile: iOS Safari ≥ 14, Android Chrome ≥ 88 ● Required capabilities: `MediaDevices.getUserMedia`, `postMessage`, ES2020, WebAssembly
iframe permission	The SDK sets `allow="camera; microphone"` on the iframe automatically. If your host page is itself embedded in a third-party iframe, camera permission must be granted at every outer level.
Node/Build (local dev only)	Node.js ≥ 18; pnpm ≥ 9

Integration Steps

Prerequisites

SDK Host URL — The service provider has deployed the SDK on a dedicated domain (e.g. https://sdk.example.com) and given you that address.
HTTPS — Browser getUserMedia requires HTTPS (localhost exempt); both the SDK Host and your host page must be served over HTTPS.
Scene SN — To report recognition/verification records, configure the scene SN as PalmMobileManager on the Palm Application Platform admin console.

`<script>` Integration

Include the loader
```

<script src="https://sdk.example.com/palm_h5/loader/palm-mobile-manager.js"></script>
```
The UMD bundle exposes only the PalmMobileManager class under the window.PalmMobileManager namespace. The Mode / PalmDirection / ResultCode enums are not exported by the UMD build — pass their serialized string/number literals directly ('registration', 'palm_direction_unspecified', 0, …).

Brief Usage Example

<script>
  const { PalmMobileManager } = window.PalmMobileManager;

  const params = {
    token: USER_TOKEN,
    userId: USER_ID,
    userName: USER_NAME,
    phoneNo: USER_PHONE_NO,
    appId: APP_ID,

    // Enum values are passed as string literals under UMD:
    // "registration" | "verification" | "recognition"
    mode: 'registration',

    // Required only when mode === "verification"
    // targetUserId: TARGET_USER_ID,

    // customHeaders: { Authorization: 'YOUR_JWT_TOKEN' },
    // enableManager: true,
    // palmDirection: 'palm_direction_unspecified',
  };

  PalmMobileManager.start(params, (r) => {
    // TODO: Handle business logic based on r.code
    console.log('[PalmMobileManager]', r);
  }).then((result) => {
    console.log('final:', result);
  });
</script>

Zero config: The loader uses its own <script src> origin as the embed site address. As long as loader and embed ship from the same SDK Host (which also covers the local vite dev server case), no extra configuration is needed on the host page.

Local Integration Testing

To test the integration locally, you do not need the SDK source — just point <script src> in your own host page at the SDK Host URL provided by the service provider.

<!-- Point at the SDK Host provided by the service provider (HTTPS) -->
<script src="https://sdk.example.com/palm_h5/loader/palm-mobile-manager.js"></script>

Your host page can run on http://localhost. localhost is a secure context; the camera is invoked from the SDK Host's HTTPS iframe, independent of the host page protocol.
If the SDK Host is a test environment using a self-signed certificate, visit <SDK Host>/palm_h5/embed/ once in the browser and accept the certificate first, otherwise the iframe will fail to load with ERR_CERT_AUTHORITY_INVALID.

API Reference

`PalmMobileManager.start(params, callback?)`

Starts one acquisition session and returns Promise<Result>. The callback and the Promise will resolve with the same Result. Only one session is allowed at a time; concurrent calls are rejected immediately with ErrSdkRuntime (10007).

Positional	Type	Required	Description
`params`	`Params`	✅	Business parameters, see below
`callback`	`(result: Result) => void`		Optional callback; the Promise resolves with the same result

Params

Configuration object for starting the SDK.

Note: When passing required and optional parameters to start the SDK, only non-null and validity checks are performed; otherwise code = 10001 is returned. Integrators should follow the format requirements below; otherwise network-related errors will be displayed to users in the Management Module.

Required Parameters

Parameter	Type	Description
`token`	`string`	User identity token for authorizing this SDK operation.
`userId`	`string`	User's unique identifier. Format: 1-64 characters. Only ASCII letters (A-Z, a-z), digits (0-9), hyphens (`-`), and underscores (`_`) are allowed. No spaces or whitespace.
`userName`	`string`	User's name. Format: 1-64 Unicode characters. Cannot consist solely of whitespace. No leading or trailing spaces (spaces between characters are permitted). Supports desensitization.
`phoneNo`	`string`	User's phone number. Format: Numbers only (4-20 digits), including country code (1-3 digits), e.g. `(+86)13800138000`. Supports desensitization.
`mode`	`Mode`	Business mode (required in Web SDK, unlike the native default of `REGISTRATION`). Options: • `Mode.Registration` (`'registration'`) — Registration mode • `Mode.Verification` (`'verification'`) — Verification mode (1:1) • `Mode.Recognition` (`'recognition'`) — Recognition mode (1:N)
`appId`	`number`	Application ID, provided by the service provider.

Optional Parameters

Parameter	Type	Default	Description
`targetUserId`	`string`	-	Target user ID to verify against. Note: Required when `mode` is `Mode.Verification`.
`enableManager`	`boolean`	`true`	Whether to start the Management Module. When `true`, starts the Management Module; when `false`, starts the Acquisition Module.
`customHeaders`	`Record<string, string>`	`{}`	Custom HTTP request headers used to reach the gateway in front of your backend (e.g. pass a JWT token).
`palmDirection`	`PalmDirection`	`Unspecified`	Which palm to use during acquisition. Options: • `PalmDirection.Unspecified` (`'palm_direction_unspecified'`) — Either palm (default) • `PalmDirection.Left` (`'left'`) — Force left palm • `PalmDirection.Right` (`'right'`) — Force right palm

Difference vs. native: The Web SDK does not expose baseUrl. The API endpoint is decided by the embed site at deployment time (through the reverse proxy inside the SDK Host). The host page cannot override it. To connect to a different backend environment, deploy the corresponding embed site.

Result

The result object delivered via callback / promise when the SDK exits.

interface Result {
  code: ResultCode;
  message: string;
  data?: RegistrationData | RecognitionData | VerificationData;
}

Property	Type	Description
`code`	`number`	Result code. See below.
`message`	`string`	Descriptive message for debugging only.
`data`	`ResultData \| undefined`	Detailed result data on success; shape depends on `mode`.

ResultData

interface RegistrationData {
  userId: string;
  palmDirection?: PalmDirection;
}

interface RecognitionData {
  userId: string;
  score: number;
  userName?: string;
  palmDirection?: PalmDirection;
}

interface VerificationData {
  isMatch: boolean;
  score: number;
  palmDirection?: PalmDirection;
}

Callback Result Codes

The Management Module automatically handles most results from the Acquisition Module. Your host page will only receive callbacks for the following result codes:

Code	Scenario	Handling Suggestion
`0`	Operation successful or user manually returns	No action needed
`10001`	Invalid parameters	Check that required fields are non-empty and `mode` / `targetUserId` are consistent
`10012`	Invalid or expired Token	Re-obtain the Token
`10401`	Gateway authentication failed	Contact the SDK Host / gateway provider, or add JWT credentials in `customHeaders`

Complete Result Code Reference

Note: The Acquisition Module (enableManager = false) does not capture result codes for internal handling — the host page must dispatch them.

Click to expand all result codes

Common Result Codes

Code	Enum	Developer Notes
0	`Success`	Operation successful (will callback)
10000	`ErrUnknown`	Unknown error
10001	`ErrInvalidParams`	Invalid parameters (will callback)
10002	`ErrUserCancelled`	User cancelled acquisition operation
10003	`ErrCameraPermissionDenied`	Camera permission denied
10004	`ErrCameraInitFailed`	Camera initialization failed
10005	`ErrCameraPreviewUnsupported`	Unsupported camera preview size
10006	`ErrSdkInitFailed`	SDK initialization failed
10007	`ErrSdkRuntime`	SDK runtime error (includes "another session in progress")
10008	`ErrAcquisitionTimeout`	Acquisition timeout (30 seconds)
10012	`ErrUserTokenInvalid`	Invalid or expired Token (will callback)
10016	`ErrLicenseValidationFailed`	Authorization certificate validation failed
10017	`ErrUserNameInvalid`	Invalid UserName format
10018	`ErrUserIdInvalid`	Invalid UserId format
10019	`ErrPhoneInvalid`	Invalid Phone Number format
10020	`ErrAppDisabled`	Application disabled
10021	`ErrUserNotExist`	User does not exist
10022	`ErrTenantRegistrationDisabled`	Tenant back-office has disabled in-app user creation
10023	`ErrTenantPhoneAlreadyExists`	Phone number already registered to another user of the same tenant
10024	`ErrTenantPalmRegistrationDisabled`	Tenant back-office has disabled in-app palm registration

Registration Mode Result Codes

Code	Enum	Developer Notes
10100	`ErrLivenessFailed`	Liveness detection failed
10101	`ErrQualityFailed`	Quality check failed
10102	`ErrLivenessVideoFailed`	Liveness video verification failed
10103	`ErrAlreadyBind`	Palm already registered
10104	`ErrHighSimilarity`	High similarity with existing user

Recognition Mode Result Codes

Code	Enum	Description
10200	`ErrUserNotRecognized`	User not recognized

Verification Mode Result Codes

Code	Enum	Description
10300	`ErrTargetUserNotFound`	Target user not found
10301	`ErrTargetUserUnregistered`	Target user has not registered any palm print
10302	`ErrTargetUserPalmDirectionUnregistered`	Target user has not registered current palm direction

Network Result Codes

Code	Enum	Description
10401	`ErrUnauthorized`	Unauthorized gateway access (will callback)
10500	`ErrNetwork`	Network error

Verification Record Report Codes

After each recognition/verification the Management Module reports one verification record (create_mobile_verification_record) with a ResultCode + FailReason, mirroring the native SDK. The reported ResultCode is resolved as follows:

Blocklist hit → 50005
Pass-through acquisition codes → reported as-is (10002 / 10008 / 10100 / 10101 / 10102)
Business success → 0
Other failures → mode fallback: recognition 50003, verification 50002

The report is fire-and-forget: a failure is logged and swallowed, never retried or queued, so it never blocks the main flow. The following codes may appear in the callback result or in the back-office audit log:

Code	Enum	Description
50002	`ErrCompareFailed`	Verification business failure fallback — no match and no more specific code (used for reporting only)
50003	`ErrRecognitionFailed`	Recognition business failure fallback — no `userId` returned and no more specific code (used for reporting only)
50005	`ErrBlacklistHit`	Live blocklist hit — the palm print has been flagged as denied by the back office. The SDK surfaces this via `result.code` and downgrades the business payload (`isMatch=false` / recognized `userId=""`) so the host cannot proceed on stale data.

Architecture

Host Page (your app)
  └─ PalmMobileManager.start(params, callback?)   // aligned with Android/iOS
       └─ <iframe src="https://sdk.xxx.com/palm_h5/embed/" allow="camera; microphone">
            └─ Manager View → Acquisition View
                 └─ getUserMedia + wasm inference + Tencent PalmAI Platform
       ←── postMessage { ns:'palm-mobile-manager', v:1, msg:{ type:'result', payload } } ──

Loader ↔ Embed enforce strict two-way origin checks: other iframes on the host page cannot forge results.

Full sequence diagram (PlantUML — click to expand)

@startuml
!theme vibrant
title Palm Mobile Manager (Web) — v2.3.0

participant "Host Page\n(customer page)" as Host

box "SDK (loader)" #LightCyan
    participant "PalmMobileManager.start()" as Loader
end box

box "SDK (embed iframe)\n<SDK Host>/palm_h5/embed/" #LightCyan
    participant "Manager View" as ManagerView
    participant "Acquisition View\n(camera + wasm)" as AcquisitionView
end box

box "Tencent PalmAI Platform" #LightCyan
    participant "SaaS Platform" as SaaSPlatform
    participant "PaaS Platform" as PaaSPlatform
    participant "Object Storage" as Storage
end box

note left of Host
  **Params** (aligned with Android/iOS same-named fields):
  - token, userId, userName, phoneNo  (required)
  - mode: registration | verification | recognition
  - targetUserId  (verification only)
  - enableManager      (default true)
  - palmDirection      (default unspecified)
  - appId, customHeaders
end note

Host ->> Loader: PalmMobileManager.start(params, callback?)
activate Loader

Loader ->> ManagerView: <<create iframe>> + postMessage(start, params)
activate ManagerView
note right of Loader
  Loader only hosts the iframe and relays
  the protocol; it never touches the
  camera / wasm directly.
  Origin checks prevent cross-iframe
  message forgery.
end note

alt enableManager == true
    group User Management
        ManagerView ->> SaaSPlatform: DescribeMobileUser(userId)
        activate SaaSPlatform
        alt User Exists
            SaaSPlatform -->> ManagerView: UserInfo (palmState, ...)
        else User Not Found
            SaaSPlatform -->> ManagerView: Error: UserNotFound
            ManagerView ->> SaaSPlatform: CreateMobileUser(userId, userName, phoneNo)
            SaaSPlatform -->> ManagerView: UserInfo
        end
        deactivate SaaSPlatform
    end

    note over ManagerView
      Render UI based on mode.
      Wait for user to start acquisition.
    end note

    ManagerView ->> AcquisitionView: start(params)
else enableManager == false
    Loader ->> AcquisitionView: start(params)  // skip Manager View
end
activate AcquisitionView

note right of AcquisitionView
  getUserMedia + libpag UI
  + wasm inference (palm detect / liveness / quality)
end note

group License Validation
    AcquisitionView ->> PaaSPlatform: DescribeMobileLicense
    activate PaaSPlatform
    PaaSPlatform -->> AcquisitionView: License
    deactivate PaaSPlatform
end

group Palm Acquisition
    AcquisitionView ->> PaaSPlatform: CreateMobilePalmVideoURL
    activate PaaSPlatform
    PaaSPlatform -->> AcquisitionView: { videoUrl, videoFileId }
    deactivate PaaSPlatform
    AcquisitionView ->> Storage: PUT video
    Storage -->> AcquisitionView: 200 OK

    alt mode == REGISTRATION
        AcquisitionView ->> PaaSPlatform: RegisterMobilePalm(rgbImage, videoPath)
        PaaSPlatform -->> AcquisitionView: RegistrationResult
    else mode == RECOGNITION
        AcquisitionView ->> PaaSPlatform: SearchRgbPalm(rgbImage, videoPath)
        PaaSPlatform -->> AcquisitionView: { userId, score, palmDirection }
    else mode == VERIFICATION
        AcquisitionView ->> PaaSPlatform: ComparePalm(rgbImage, targetUserId, videoPath)
        PaaSPlatform -->> AcquisitionView: { isMatch, score, palmDirection }
    end
end

AcquisitionView -->> ManagerView: Result(code, message, data)
deactivate AcquisitionView

opt enableManager && (mode == RECOGNITION || mode == VERIFICATION) && directionCode != 0
    ManagerView ->> SaaSPlatform: QueryLiveBlacklist(userId, palmDirection)
    activate SaaSPlatform
    SaaSPlatform -->> ManagerView: LiveBlacklistInfos
    deactivate SaaSPlatform
    alt blacklist hit
        note right of ManagerView
          Rewrite result to ErrBlacklistHit (50005),
          downgrade business data (isMatch=false / userId=""),
          aligned with native applyBlacklistThenReport.
          Query failure falls through — availability first.
        end note
    end
end

opt enableManager && (mode == RECOGNITION || mode == VERIFICATION)
    note right of ManagerView
      reported ResultCode resolution:
        blacklist    -> 50005
        pass-through -> 10002/10008/10100/10101/10102 as-is
        biz success  -> 0
        otherwise    -> fallback (recognition 50003 / verification 50002)
    end note
    ManagerView ->> SaaSPlatform: CreateMobileVerificationRecord(ResultCode, FailReason)
    activate SaaSPlatform
    alt success
        SaaSPlatform -->> ManagerView: Ack
    else failure (any)
        SaaSPlatform -->> ManagerView: Error
        note right of ManagerView
          Fire-and-forget: failure is logged
          and swallowed, never retried.
        end note
    end
    deactivate SaaSPlatform
end

ManagerView -->> Loader: postMessage(result)
deactivate ManagerView
Loader -->> Host: Promise resolve / callback(result)
deactivate Loader

note left of Host
  **Result**:
  - code: number  (0 = success)
  - message: string
  - data: RegistrationData | RecognitionData | VerificationData

  **App-facing callback codes** (enableManager=true):
  | 0     | Success or user exit |
  | 10001 | Invalid parameters |
  | 10012 | Token invalid/expired |
  | 10401 | Gateway auth failed |

  Recognition / verification may also surface
  50005 (ErrBlacklistHit); acquisition-stage codes
  such as 10024 (ErrTenantPalmRegistrationDisabled)
  are likewise passed through.

  When enableManager=false, the host must dispatch
  the full ResultCode set itself.
end note

@enduml

Security Warning

Production Environment Security Requirements

NEVER hardcode any platform account credentials in browser code!

Browser code is visible to every user; leaking platform credentials exposes your account to all users, allowing attackers to exploit them and cause severe damage to your services. All credential-bearing calls (e.g. CreateAccessToken / CreateUser) must happen on your server; the browser only receives short-lived AccessToken values pushed down from your backend.

Correct Approach (Production):

- **Management Module**
Browser --[UserId]--> Your Server --[Call CreateAccessToken]--> Tencent PalmAI Platform
Browser <--[AccessToken]-- Your Server <--[AccessToken]-- Tencent PalmAI Platform

- **Acquisition Module**:
Browser --[UserId (unregistered)][UserName]--> Your Server --[Call CreateUser]--> Tencent PalmAI Platform
Browser --[UserId (registered)]--> Your Server --[Call CreateAccessToken]--> Tencent PalmAI Platform
Browser <--[AccessToken]-- Your Server <--[AccessToken]-- Tencent PalmAI Platform

Session Uniqueness

The Web SDK allows only one active session at a time. Concurrent PalmMobileManager.start() calls are rejected immediately with ErrSdkRuntime (10007) to prevent multiple iframes from contending for the camera.

Quick Start for Testing Environments

For local development / internal testing / isolated demo environments only. Demonstrates how to wire up a pre-issued test token in the browser:

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8" />
  <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover" />
  <title>Palm Scan H5 Test Page</title>
</head>
<body>
  <button id="startBtn">Start Palm Scan</button>
  <pre id="result"></pre>

  <script src="https://<sdk-host>/palm_h5/loader/palm-mobile-manager.js"></script>
  <script>
    // [For Testing Only] Hard-code the pre-issued test token in the page
    // WARNING: In production, tokens MUST be obtained from your backend at request time.
    const USER_TOKEN = 'eyJhbGciOi...'; // signed in advance by your backend's CreateAccessToken
    const APP_ID = 0;                   // Replace with the AppId issued to you
    const USER_ID = 'YourUserId';
    const USER_NAME = 'YourUserName';
    const PHONE_NO = '(+86)13088888888';
    const MODE = 'registration';        // 'registration' | 'verification' | 'recognition'

    const { PalmMobileManager } = window.PalmMobileManager;
    const resultEl = document.getElementById('result');

    document.getElementById('startBtn').addEventListener('click', async () => {
      try {
        const result = await PalmMobileManager.start({
          token: USER_TOKEN,
          appId: APP_ID,
          userId: USER_ID,
          userName: USER_NAME,
          phoneNo: PHONE_NO,
          mode: MODE,
        });
        resultEl.textContent = JSON.stringify(result, null, 2);
      } catch (err) {
        resultEl.textContent = `Error: ${err?.code ?? ''} ${err?.message ?? err}`;
      }
    });
  </script>
</body>
</html>

Next Steps & Support

Get Technical Support: If you encounter any issues during integration, please contact your technical support representative.

Core Modules​

Management Module​

Acquisition Module​

Features​

Core Concepts​

SDK Host​

Workflow​

1. Obtain User Token​

2. Start the SDK​

3. Automated Flow​

4. Receive Callback​

Runtime Requirements​

Integration Steps​

Prerequisites​

<script> Integration​

Local Integration Testing​

API Reference​

PalmMobileManager.start(params, callback?)​

Params​

Required Parameters​

Optional Parameters​

Result​

ResultData​

Callback Result Codes​

Complete Result Code Reference​

Common Result Codes​

Registration Mode Result Codes​

Recognition Mode Result Codes​

Verification Mode Result Codes​

Network Result Codes​

Verification Record Report Codes​

Architecture​

Security Warning​

Production Environment Security Requirements​

Session Uniqueness​

Quick Start for Testing Environments​

Next Steps & Support​