Didit vs Keyless: verifying new users vs biometric login

Editorial update: 27 October 2026 · Ping sources checked 25 October 2026; official sandbox report checked 27 October 2026

Where you verify identity in the user lifecycle determines what software you need. Didit and Keyless (PingOne Recognize) solve two different problems.

Didit focuses on onboarding: establishing the real-world identity of an unknown applicant, proving that a live person is present, validating documents across more than 220 countries and territories, using government database validation, and checking sanctions before opening an account. Keyless, acquired by Ping Identity in January 2026 and integrated into its identity suite as PingOne Recognize, focuses on returning sessions: authenticating previously enrolled users during sign-in, in-app step-up, or payment step-up via facial biometrics.^[1][3][4]

The onboarding workflow vs. authentication workflow

To see why onboarding requires a dedicated identity platform, consider how a user moves through each workflow:

In a standard Didit onboarding workflow, an applicant lands on a signup screen and initiates verification. Didit collects device and IP risk signals in the background, guides the applicant through document capture with AI-powered OCR across 14,000+ document types, captures a passive or active selfie, and executes a 1:1 face match. Simultaneously, Didit runs a 1:N face search across all historical enrollments and custom blocklists in your account to prevent duplicate accounts. The workflow then runs government database validation in 45 countries plus a Global group, screens the applicant against 1,300+ lists covering sanctions, PEP and adverse media, and produces an auditable evidence package containing the extracted data, raw images, and forensic telemetry with retention you configure. Once approved, the user's profile is fully established.

By contrast, PingOne Recognize requires an enrolled user. Its workflow begins at enrollment: an enterprise captures a facial scan using the PingOne Recognize SDK or imports imagery from an existing IDV provider via its IDV Bridge.^[6] Once enrolled, Recognize sends captured images in encrypted form to verify matches against the enrolled user without storing retrievable biometric templates.^[2][5] When that user signs in, updates an account, or authorizes a payment under PSD2, the Recognize SDK performs a facial check against the device and can issue a signed JSON Web Token (JWT) containing a custom payload.^[4][5]

Comparing Didit and PingOne Recognize (formerly Keyless)

The table compares the product scope documented by each provider.

Didit also provides electronic signature capabilities within verification workflows (AES, PAdES), configurable custom questionnaires inside onboarding flows, bank account ownership verification via open banking protocols, crypto wallet screening in Didit ($0.15 per check), and Travel Rule compliance messaging.

Worked cost comparison

Use these list prices to budget completed KYC bundles at three monthly volumes. The Didit bundle reflects list prices for successful completed onboarding checks including ID document verification ($0.15), passive liveness detection ($0.10), 1:1 facial match ($0.05), and session-level device and IP analysis ($0.03)—totaling $0.33 per check.

Ping's pricing page publishes no price for PingOne Recognize; its IDV Bridge documentation says charges are based on users (sources checked 25 October 2026).^[6][9] The table therefore shows no estimated Recognize total for new-user KYC volumes.

Figures reflect list-price calculations for successful completed checks in USD before applicable taxes, volume discounts, credits, or additional modules. Optional compliance additions on Didit include AML screening ($0.20), ongoing AML monitoring ($0.07 per user per year), KYB verification (from $2.00), and transaction monitoring ($0.02 per event).

Public proof and operational evidence

Didit serves 3,000+ companies. The following sources document its security credentials, a tested verification flow and a customer outcome:

• Spain's published sandbox report documents tests of Didit's NFC and active-liveness flow. Its supervisory conclusions state that SEPBLAC positively assessed the added safeguards for remote identification (official report, checked 27 October 2026).
• Security certifications: ISO/IEC 27001 certification and SOC 2 Type 1 and Type 2 attestation reports.^[15] Data is processed and stored in the EU by default.^[16]
• Global document reach: AI-powered recognition engine supporting 14,000+ identity documents across more than 220 countries and territories.^[10]
• Customer results: In a published customer story, digital asset platform AhoraCrypto reported achieving more than 20% savings per user compared with its previous verification provider, alongside an over 50% reduction in time spent conducting manual reviews.^[23]

Forensic evidence extraction and attack telemetry

When compliance teams decline a fraudulent application or face an audit, they need clear proof. Didit captures and exposes full forensic telemetry on every verification session.

In addition to producing a normalized 0–100 liveness confidence score and matching portraits against identity credentials, Didit analyzes the video stream to differentiate physical presentation spoofing from sophisticated digital injection attacks. The decision payload delivers machine-readable forensic flags:

• VIRTUAL_CAMERA_DETECTED: Identifies video streams originating from emulated camera drivers, software loopbacks, or virtual media software.^[12]
• FRAME_INJECTION_SUSPECTED: Indicates captured frames show signs of injection or emulated hardware.^[12]
• INJECTION_ATTACK_DETECTED: Indicates the capture was injected rather than taken by the device's own camera.^[12]
• LOW_LIVENESS_SCORE: A score at or below the review threshold routes to In Review; a score at or below the decline threshold routes to Declined.^[12]

Detecting multi-accounting with automated 1:N face search

A primary failure point when applying biometric authentication tools to onboarding is the difference between 1:1 matching and 1:N duplicate detection. Authenticating a returning user checks a single claim: Is this returning user the same individual who registered this specific device?

Onboarding defense requires answering a different question: Has this individual opened an account previously under a different name, synthetic identity, or stolen credential?

Didit executes automated 1:N face search across your users and blocklists as a free platform feature. On each liveness step, Didit runs a face search against previous sessions and blocklisted profiles. If a match occurs with a different name or session, Didit surfaces the similarity score and matching session details, flagging the duplicate or halting the workflow based on your review policy.

Didit compares applicant faces with earlier sessions and blocklisted faces.

Watch: Duplicate Account Detection (Didit Academy)

Government database validation and live national eIDs

Database sources, returned fields and prices vary by service. These checks are separate from the $0.33 document KYC bundle.

Didit supports additional checks against authoritative records and live national eIDs. Configure these where your policy needs evidence beyond document capture:

• Direct database validation: Database validation runs as an extra check on top of document, liveness and face match, across 45 countries plus a Global group. The platform corroborates applicant details directly against authoritative source records.
• Live national digital eIDs: Didit integrates six live national electronic identity schemes: MitID (Denmark), BankID Sweden (Sweden), iDIN (Netherlands), Finnish Trust Network (Finland), Smart-ID (Estonia, Latvia, Lithuania, Belgium), and Mobile-ID (Estonia, Lithuania). In regions where these systems operate, users can verify their identity using national eID credentials, without uploading a document. A signed eID result returns identity attributes, not a portrait or selfie match; configure document and liveness capture when your policy needs a face comparison (national eID docs).

Onboarding evidence vs. session verification

Compliance and fraud leaders evaluating these tools often ask whether an authentication tool can fulfill onboarding compliance. The two solve different stages of the lifecycle.

PingOne Recognize verifies returning enrolled users for login, step-up actions, and PSD2 dynamic linking.^[4][5] For new-user onboarding, teams need to inspect and retain the evidence required by their own policy. Didit provides document captures, liveness results and decision records, with configurable retention and EU processing by default.^[16]

For organizations needing to verify new applicants, Didit establishes real-world identity, validates credentials across more than 220 countries and territories, screens against sanctions, and monitors transactions on one unified platform.

Migrating onboarding verification to Didit

Move new-user verification through a staged rollout: test the workflow, map decisions and review ownership, reconcile historical records, then expand traffic based on observed results.

1. Step 1Parallel sandbox pilotCreate an account in the self-serve Didit console at business.didit.me. Construct your onboarding flow in the no-code workflow studio, configure automated review thresholds, and simulate verification runs against production edge cases.
2. Step 2Data and webhook mappingMap your application lifecycle states to Didit verification events. Align Didit decision outcomes (Approved, Declined, In Review) and forensic webhook alerts with your internal account provisioning endpoints.
3. Step 3Historical verification ingestionMigrate historical customer verification records using the Didit Import API (POST /v3/session/imports/). Pass your designated workflow_id and define explicit status_mapping rules. Run test batches with dry_run: true, inspect the terminal job result, and reconcile created, updated, skipped, and failed counters before committing data. Note that this API endpoint imports verification data records; monitoring rules, review queues, and custom workflows are configured separately in the console.
4. Step 4Gradual traffic transitionDirect a pilot allocation of live onboarding traffic to Didit hosted links or native mobile SDKs. Measure completion speed, evaluate automated pass rates, and reconcile operational metrics before expanding production traffic.

The full Didit platform

Keep KYC, KYB, fraud checks, AML and transaction monitoring on one customer record, with crypto wallet screening and Travel Rule tools in the same account. Review cases with Investigator ($0.20 per reviewed item, within your policy), build workflows with Copilot and connect your own agents through the hosted MCP server with OAuth 2.1 authorization.

The self-serve console includes sandbox access. The publicly announced Free plan provides $10 of monthly credit from 1 November 2026. Price your flow from the module list and test the evidence before moving production traffic.

Sources

1. PingOne Recognize Product Overview, Ping Identity, accessed 25 October 2026.
2. Zero-Knowledge Biometrics Architecture, Ping Identity, accessed 25 October 2026.
3. Ping Identity Marks Digital Trust Milestone with Zero-Knowledge Biometrics, Ping Identity Press Release, accessed 25 October 2026.
4. Introduction to PingOne Recognize, Ping Identity Documentation, accessed 25 October 2026.
5. PingOne Recognize: Authentication Concepts, Ping Identity Documentation, accessed 25 October 2026.
6. PingOne Recognize: IDV Bridge Overview, Ping Identity Documentation, accessed 25 October 2026.
7. PingOne Recognize Mobile SDK Integration, Ping Identity Documentation, accessed 25 October 2026.
8. PingOne Recognize Web SDK Components, Ping Identity Documentation, accessed 25 October 2026.
9. Ping Identity Platform Pricing, Ping Identity, accessed 25 October 2026.
10. Didit Pricing Schedule, Didit Documentation, accessed 25 October 2026.
11. Didit Liveness Verification Reporting, Didit Documentation, accessed 25 October 2026.
12. Didit Liveness Warnings Reference, Didit Documentation, accessed 25 October 2026.
13. Didit Face Search 1:N Overview, Didit Documentation, accessed 25 October 2026.
14. Didit Database Validation, Didit Documentation, accessed 25 October 2026.
15. Didit Certifications and Attestations, Didit Documentation, accessed 25 October 2026.
16. Didit Security and Compliance, Didit Documentation, accessed 25 October 2026.
17. Didit AML Screening and Monitoring, Didit Documentation, accessed 25 October 2026.
18. Didit Native SDKs, Didit Documentation, accessed 25 October 2026.
19. Didit Web SDKs and Hosted Integration, Didit Documentation, accessed 25 October 2026.
20. New Pricing Announcement (November 2026), Didit Blog, accessed 25 October 2026.
21. Didit Business Verification Overview, Didit Documentation, accessed 25 October 2026.
22. Didit Transaction Monitoring Overview, Didit Documentation, accessed 25 October 2026.
23. AhoraCrypto Customer Success Story, Didit Blog, accessed 25 October 2026.