Your first ceremony

// install:  go get github.com/ydentifi/go

// 0. Connect over mutual TLS — your client cert identifies your RP.
client, err := ydentifi.New(
    ydentifi.WithServerAddr("ydentifi.acme.internal:443"),
    ydentifi.WithCertFiles("rp.crt", "rp.key"), // your RP client cert
    ydentifi.WithCAFile("ca.crt"),              // your deployment root CA
)
if err != nil { /* handle */ }
defer client.Close()

// 1. Create an opaque user. Do this ONCE per real person and keep the
//    opaque_id -> person mapping on your side (see the gotcha below).
opaqueID, err := client.CreateUser(ctx)
if err != nil { /* handle */ }

// 2. Issue a challenge over the EXACT action, at the tier you require.
ch, err := client.IssueAuthChallenge(ctx, ydentifi.IssueAuthChallengeRequest{
    OpaqueID:    opaqueID,
    TTLSeconds:  120,
    Context:     []byte("Approve €4,200 transfer to ···· 8842"),
    MinStrength: ydentifi.AuthStrengthBiometric, // required — no implicit default
})
if err != nil { /* handle */ }
// Render ch.QREncoded as a QR, or push it to the enrolled device.

// 3. Block until the challenge is terminal — the SDK holds the stream open
//    and returns the deployment-verified verdict. No polling, no webhook.
result, err := client.AwaitChallenge(ctx, ch.ChallengeID)
if err != nil { /* handle */ }
switch result.Status {
case ydentifi.ChallengeStatusApproved:
    proceed() // 4. the deployment already verified the signature + strength
case ydentifi.ChallengeStatusDenied:
    reject(result.DenialReason)
case ydentifi.ChallengeStatusExpired:
    // issue a fresh challenge
}

// no SDK — generate Go stubs from the public proto:  buf generate

// Raw gRPC — no SDK. Dial with your mTLS material, then call.
creds := credentials.NewTLS(&tls.Config{
    Certificates: []tls.Certificate{rpCert}, // your client cert
    RootCAs:      trustPool,                 // your deployment CA
})
conn, err := grpc.Dial("ydentifi.acme.internal:443",
    grpc.WithTransportCredentials(creds))
if err != nil { /* handle */ }
defer conn.Close()
client := identity.NewIdentityServiceClient(conn)

u, err := client.CreateUser(ctx, &identity.CreateUserRequest{})
if err != nil { /* handle */ }

iss, err := client.IssueAuthChallenge(ctx, &identity.IssueAuthChallengeRequest{
    OpaqueId: u.OpaqueId, TtlSeconds: 120,
    Context: []byte("Approve €4,200 transfer to ···· 8842"),
    MinStrength: identity.AuthStrength_BIOMETRIC, // required — no implicit default
})
if err != nil { /* handle */ }

stream, err := client.AwaitChallenge(ctx,
    &identity.AwaitChallengeRequest{ChallengeId: iss.ChallengeId})
if err != nil { /* handle */ }
for {
    frame, err := stream.Recv()
    if err == io.EOF { break }
    if err != nil { /* handle */ }
    if frame.Status == identity.AuthChallengeStatus_AUTH_CHALLENGE_STATUS_APPROVED {
        proceed() // deployment-verified; frame.Signature is yours to log
    }
}

# install:  pip install ydentifi

# 0. Connect over mutual TLS.
client = ydentifi.Client(
    server_addr="ydentifi.acme.internal:443",
    cert_path="/etc/ydentifi/rp.crt",  # your RP client cert
    key_path="/etc/ydentifi/rp.key",
    ca_path="/etc/ydentifi/ca.crt",    # your deployment root CA
)

# 1. Create an opaque user (once per real person; keep the mapping).
opaque_id = client.create_user()

# 2. Issue a challenge over the exact action, at the tier you require.
challenge = client.issue_auth_challenge(ydentifi.IssueAuthChallengeRequest(
    opaque_id=opaque_id,
    ttl_seconds=120,
    context="Approve €4,200 transfer to ···· 8842".encode(),
    min_strength=ydentifi.AuthStrength.BIOMETRIC,   # required
))
# render challenge.qr_encoded as a QR

# 3. Block until terminal — the deployment verifies and returns the verdict.
result = client.await_challenge(challenge.challenge_id)
if result.status == ydentifi.ChallengeStatus.APPROVED:
    proceed()                                       # 4. proceed
elif result.status == ydentifi.ChallengeStatus.DENIED:
    reject(result.denial_reason.name)
elif result.status == ydentifi.ChallengeStatus.EXPIRED:
    pass                                            # issue a fresh challenge

// install:  npm install @ydentifi/client

// 0. Connect over mutual TLS.
const client = new Client({
  serverAddr: "ydentifi.acme.internal:443",
  certPath: "/etc/ydentifi/rp.crt",  // your RP client cert
  keyPath: "/etc/ydentifi/rp.key",
  caPath: "/etc/ydentifi/ca.crt",    // your deployment root CA
});

// 1. Create an opaque user (once per real person; keep the mapping).
const opaqueId = await client.createUser();

// 2. Issue a challenge over the exact action, at the tier you require.
const ch = await client.issueAuthChallenge({
  opaqueId,
  ttlSeconds: 120,
  context: Buffer.from("Approve €4,200 transfer to ···· 8842"),
  minStrength: AuthStrength.Biometric,  // required
});
// render ch.qrEncoded as a QR

// 3. Block until terminal — the deployment verifies and returns the verdict.
const result = await client.awaitChallenge(ch.challengeId, AbortSignal.timeout(120_000));
if (result.status === ChallengeStatus.Approved) {
  proceed();  // 4. proceed
} else if (result.status === ChallengeStatus.Denied) {
  reject(result.denialReason);
} else if (result.status === ChallengeStatus.Expired) {
  // issue a fresh challenge
}