Skip to main content

​
States

Once verified, the worker issues a signed session cookie scoped to your domain. The cookie contains:
  • A session ID (used for usage tracking)
  • The verification timestamp
  • A signature (HMAC, validated by the worker on each request)
The worker validates this signature locally on every request — no API call is needed for returning verified visitors.

​
Re-verification

Visitors are not re-verified during an active session. When the session expires, they will be prompted again on their next visit to a protected page. There is no way for a visitor to “log out” of their Veriox session — the cookie expires naturally. Changing your Session Duration in the portal only affects sessions issued after the change; existing sessions keep the expiry they were issued with and are not retroactively shortened or invalidated. There is currently no way to force immediate re-verification for visitors who already hold a valid session.