instantscan.io turns a phone camera into a document scanner you can drop into an existing form. Your user points at a page; you receive a cropped, deskewed PDF.
Two things are worth understanding before you read anything else, because every other decision in these docs follows from them.
The engine does not run on your page
Only a ~6 KB launcher runs on your site. Everything expensive — camera handling, live edge detection, the perspective transform, PDF assembly — runs on our origin inside an iframe.
That split is not an implementation detail you can ignore:
- Your bundle does not grow, and you never ship a computer-vision library.
- Fixes and new device workarounds reach your users without you redeploying.
- The launcher, your publishable key and the session token are all public by definition. They are designed to be safe when extracted, rather than hidden. See Security model.
Everything is a session
A session is a short-lived object representing one scan. You open one, the user scans into it, and it produces exactly one PDF.
your server or browser our API the user's device
───────────────────── ──────── ─────────────────
POST /v1/sessions ───────▶ create session
charge 1 credit (live only)
◀─────── { id, client_token, scan_url }
open scan_url in an iframe, or render it as a QR code
───▶ hosted scanner boots
GET /v1/scanner/config
camera, detection, PDF
│
▼
PUT the PDF ──▶ storage
◀─── POST /v1/scanner/complete
store result
POST your endpoint ◀─────── scan.completed (signed)The PDF goes straight from the device to storage rather than through the API. That is one fewer system holding a copy of someone’s identity document, and it is what allows a 25 MB scan at all.
How the user reaches the session — a modal on your page, or a phone that scanned a QR code — is a choice you make per integration, not a different product.
Pick a starting point
| If you want to… | Read |
|---|---|
| See it working, fastest | Quickstart |
| Turn an existing file input into a scanner | Embed SDK |
| Support desktop users with no camera | QR hand-off |
| Receive results on your server | Webhooks |
| Make it look like your product | Customization |
| Understand billing | Credits and metering |
| Handle failures properly | Errors |
| Ship to production | Going live |
| Look up an endpoint | API reference |
Conventions in these docs
Every sample uses the seeded demo keys that a fresh local install creates:
pk_test_demo and sk_test_demo. They are test-mode keys on the demo tenant, they debit that
tenant’s credits like any other session, and they are deliberately not secret. Nothing in these docs
is a real credential.
The base URL in samples is https://api.instantscan.io. Running locally, that is
http://localhost:8787.