> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qa.esectra.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Deployment requirements

> What a deployment needs before the verification flow can be tested.

The hosted capture page and the API are served from one origin, so calls to `/v1` from the page need no CORS configuration.

TLS is required to test the verification flow. The hosted capture page calls `getUserMedia`, which browsers refuse outside a secure context, so a deployment serving plain HTTP cannot exercise the camera step at all. A local deployment that issues certificates from its own CA still shows a browser warning until that root is trusted, which is not the same as running without TLS.

Both self-hosted and cloud deployments need TLS for browser camera access, durable storage, secret management, and backups.