1. Choose the Neuron and purpose
Use an HTTPS Neuron that provides Quick Login. The public example useshttps://eu.id.tagroot.io. A user needs Neuro Access or another compatible app with a Legal Identity accepted by the provider.
Write a purpose that names your application and explains what approving will do. The live demo explicitly asks to display identity information on this documentation page.
2. Register for events
The reference Events.js provides aTabID and registers it for client events. A custom client can use the same WebSocket protocol:
{"cmd":"Ping"} every ten seconds while connected and {"cmd":"Unregister"} before closing. Handle connection loss and malformed messages, and dispatch only the event names your application expects.
3. Request and display the QR code
Use the sametab value as the event registration:
signUrl for users on the same device as their identity app. Keep the QR on a white background with its full margin visible. Do not send signUrl to a third-party QR rendering service.
4. Receive the approved identity
Scan the QR, review the purpose in the identity app, and approve. The Neuron pushes aSignatureReceived event to the registered tab. Its data contains the identity response.
Until completion, request fresh codes at the reference client’s two-second interval, with no overlapping requests. Stop after approval, cancellation, connection failure, or a bounded waiting period. Clear timers, abort pending HTTP requests, and close the WebSocket when leaving the page. Cancellation in your UI stops local waiting; it does not revoke already issued codes before their five-minute expiry.
Use the reference browser scripts
The upstream Web API guide also supports aquickLoginCode element with data-mode, data-purpose, and optional data-serviceId, together with /Events.js, /QuickLogin.js, and a <meta name="NEURON" content="your-neuron-host" /> header.
Adapt these scripts to your page before embedding them. The currently deployed QuickLogin.js expects property-filter and attachment-filter controls and redirects to / after five minutes. Loading it unchanged into a documentation site or single-page app introduces those behaviors. A custom component can keep its timers, callbacks, and results scoped to its own lifecycle.
For a different website origin, the provider must allow the HTTP request through CORS and accept the WebSocket origin. Session modes also require compatible cookies. See connection troubleshooting.