> ## Documentation Index
> Fetch the complete documentation index at: https://docs.veriox.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Verification Lifecycle

> The states a verification moves through from attempt to expiry.

## States

```
Unverified → Pending → Verified → Expired
                ↓
              Failed
```

| State          | Description                                                                                       |
| -------------- | ------------------------------------------------------------------------------------------------- |
| **Unverified** | Visitor has no session cookie. The popup will be shown.                                           |
| **Pending**    | Visitor has opened the popup and a proof request is in progress.                                  |
| **Verified**   | Proof was accepted. A session cookie has been issued.                                             |
| **Failed**     | Proof was rejected (invalid proof, identity issues). The visitor is shown an error and can retry. |
| **Expired**    | The session cookie has passed its TTL. The visitor is treated as unverified on their next visit.  |

## Session cookie

Once verified, the worker issues a signed session cookie scoped to your domain. The cookie contains:

* A session ID (used for usage tracking)
* The verification timestamp
* A signature (HMAC, validated by the worker on each request)

The worker validates this signature locally on every request — no API call is needed for returning verified visitors.

## Re-verification

Visitors are not re-verified during an active session. When the session expires, they will be prompted again on their next visit to a protected page.

There is no way for a visitor to "log out" of their Veriox session — the cookie expires naturally. Changing your **Session Duration** in the portal only affects sessions issued after the change; existing sessions keep the expiry they were issued with and are not retroactively shortened or invalidated. There is currently no way to force immediate re-verification for visitors who already hold a valid session.