# Camera and Permissions

The Digital ID WebView SDK supports the liveness camera on iOS and Android.
The widget uses the standard `navigator.mediaDevices.getUserMedia()` API.
There is no custom camera-request bridge.

The SDK observes the web request, applies its policy, and controls the native
permission request.
The widget uses the camera in step 2 of the
[user journey](/digital-id/concepts/user-journey).

## Web contract

Request video only:

```js
navigator.mediaDevices
  .getUserMedia({ video: true })
  .then((stream) => {
    // Continue with liveness.
  })
  .catch((error) => {
    switch (error.message) {
      case "camera_unsupported":
        // Ask the user to update the device.
        break;
      case "camera_missing_permission":
        // Tell the user that the host cannot use the camera.
        break;
      default:
        // Handle NotAllowedError, NotFoundError, or NotReadableError.
        break;
    }
  });
```

Apply these requirements:

1. Request `{ video: true }`.
2. Do not request audio with the video.
3. Handle a rejected promise and provide retry or fallback content.
4. Load the widget and redirect origins over HTTPS.
5. Request the camera only when the liveness step starts.
6. Do not use a popup or new window for camera capture.

| Constraints | Native capture type | SDK result |
| --- | --- | --- |
| `{ video: true }` | Camera | Permitted when the origin and OS permission are valid. |
| `{ video: true, audio: true }` | Camera and microphone | Denied. The complete request fails. |
| `{ audio: true }` | Microphone | Denied. |
| Display capture | Display | Denied. |

The SDK returns `camera_unsupported` or `camera_missing_permission` before it
accesses the camera. User denial and hardware failures use standard
`DOMException` values.

## iOS requirements

On iOS, `getUserMedia` uses
`WKUIDelegate.requestMediaCapturePermissionFor`. The SDK permits only the
`.camera` capture type when the origin and frame meet the HTTPS policy.

- In-WebView capture requires iOS 14.3 or later.
- The host application must define `NSCameraUsageDescription`.
- The native permission alert appears on first use.

If the application does not define the usage description, the SDK returns
`camera_missing_permission`.

```xml
<key>NSCameraUsageDescription</key>
<string>Digital ID uses the camera to capture identity verification images.</string>
```

## Android requirements

On Android, `getUserMedia` calls
`WebChromeClient.onPermissionRequest` for `RESOURCE_VIDEO_CAPTURE`. The SDK
permits video and denies audio or other resources.

- The SDK manages the runtime `CAMERA` permission on API 23 and later.
- The application manifest must define `android.permission.CAMERA`.
- Use a WebRTC-capable System WebView over HTTPS.
- Set an approximate minimum SDK level of API 24 or later.
- A permanent permission denial provides a link to the application settings.

If the manifest does not define the permission, the SDK returns
`camera_missing_permission`. If the System WebView does not support the
required capture, the SDK returns `camera_unsupported`.

```xml
<uses-permission android:name="android.permission.CAMERA" />
```

> Do not send a request to a native camera bridge. Do not add audio to the
> liveness request. Do not use a non-HTTPS page, popup, or new window.