# Verification Flow

Privy controls the order of the verification steps on its servers. The user
cannot skip a required step: OTP follows the face match, and consent follows
OTP. Both data packages use the same flow.

```text
Identifier input → Liveness + face match → OTP → Consent → Success
```

| Widget screen | What happens | Widget event |
| --- | --- | --- |
| Identifier input | The user enters a PrivyID, email, NIK, or mobile number. | `privy:ready` on startup |
| Liveness + face match | Privy checks that a live person is present and compares the face with the face on file. | None |
| OTP | The user confirms a one-time password. | None |
| Consent | The user reviews the data that the merchant receives. | None |
| Success | The user continued. | `privy:success` |
| Identifier input error | The identifier does not match a registered identity. | None |
| No data shared | The user rejected the request, or the confirmation window ended. | `privy:cancel` if rejected. `privy:error` with `session_expired` if timed out. |
| Blocked | Three liveness or face-match attempts failed. The session cannot continue. | `privy:error` |

The [user journey](/digital-id/concepts/user-journey) shows the screen for each
step. The [session lifecycle](/digital-id/concepts/session-lifecycle) explains
how to keep and reuse a session.