> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://infonite.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://infonite.dev/_mcp/server.

# What is a flow

A **flow** is a complete journey we host and you embed. You create a session from your backend, send your customer to the URL it returns, and the INFONITE widget takes it from there: it explains what is being asked for, collects consent, walks the person through authenticating with each institution, and hands the records back to your systems.

What that buys you is not a UI. It is **not being in the middle of somebody's credentials.**

**The end user's secrets never touch your servers.** They are entered in our widget, used against the institution, and never returned to you. Your integration handles a `session_id` and a set of records — never a password, never a *Cl\@ve* code, never a one-time SMS.

---

## What a flow is made of

#### A session you create

One server-to-server call from your backend says *who* the customer is, *what* you need (the features: labor check, taxes, vehicles…) and *how* you want the results delivered. You get back a `widget_url` and a `session_id`.

#### An experience we run

The widget is a hosted web experience — open it in an iframe, a new tab, or a mobile web view. It adapts to what the chosen institutions actually require: a *Cl\@ve Móvil* push, a QR, an SMS code, a certificate. When an institution changes its login, the flow changes; your integration does not.

#### Consent, recorded

Before anything is read, the person is shown what will be requested and signs their agreement. That consent is stored as evidence with the session — it is what makes the extraction lawful, and it is auditable afterwards.

#### Records, delivered to you

Structured data plus the official supporting documents, pushed to you as [webhooks](/flows/spain-public-administration/webhooks) or pulled from the session API — optionally [encrypted with a key only you hold](/guides/payload-encryption).

---

## It is yours, visually

The widget carries **your** brand, not ours. From the console you set the display name your customer reads, the logo, the primary and secondary colours, light or dark, rounded or sharp, and how the experience ends — stay put, redirect, or close the tab, with the parameters you need carried back in the URL.

The result is an experience that belongs to your product. To the person using it, it is your onboarding — not a third-party page they were bounced to.

#### [Redirects & Completion](/flows/spain-public-administration/redirects)

How to bring the customer back where you want them when the widget is done, with the context you need to resume your own process.

---

## Flows versus calling the API directly

A flow exists because **a person has to be present**: only they can approve access to their own records, and only they can complete an authentication that the institution sends to their phone.

That is the dividing line for the whole platform:

|                                           | **Flows**                             | **Direct executions**                                            |
| :---------------------------------------- | :------------------------------------ | :--------------------------------------------------------------- |
| Who faces the end user                    | Our widget, wearing your brand        | You do, or nobody does                                           |
| Who holds the credentials                 | The person, in our widget — never you | You send them with the request                                   |
| Consent                                   | Collected and stored by the flow      | Yours to obtain and evidence                                     |
| When an institution needs a second factor | The widget handles it                 | Your integration has to                                          |
| Fits when                                 | The person is there, in a browser     | You already hold what is needed and want a server-to-server call |

**Direct executions are documented separately, and are coming.** They call the same engines without a widget, for the cases where a person is not in front of a screen. If that is your situation, [talk to support](mailto:support@infonite.tech) — the API is live, its reference is being written.

---

## The flows available today

#### [Spain Public Administration](/flows/spain-public-administration/overview)

Official records from the Spanish administrations — *Vida Laboral* and contribution history, AEAT tax declarations, DGT driver and vehicle records, MEC degrees, and the Banco de España's CIRBE credit registry.

#### [Bank Reader](/flows/bank-reader/overview)

Account, transaction and certificate data straight from the account holder's own bank.

#### [What comes back](/guides/data-models/overview)

Every flow returns the same shared models. The data models reference explains each one field by field — read it while you design, not after.