Serpro Datavalid and gov.br: a guide for businesses in Brazil
Serpro Datavalid validates a person's data and face against Brazilian government databases; gov.br is the citizen login. What each returns, who can contract them, prices, limits and the document fallback.
In short
Serpro Datavalid is the paid API a company uses to check a person's data and face against Brazilian government databases. gov.br is the citizen account, with bronze, silver and gold levels, that Brazilians use to sign in to public services.[4][1] One is a back-end check, the other a login.
- gov.br had more than 178 million users on 24 September 2026, according to Agência Brasil quoting the MGI,[6] up from about 172 million in December 2025, according to Convergência Digital quoting the MGI.[5]
- Datavalid is billed per validation with no monthly fee, and the contract needs an e-CNPJ digital certificate.[3][4]
- The gov.br login guide addresses public bodies. Private-company access is not confirmed as of 5 October 2026.[2]
This guide follows the official gov.br and Serpro pages, read in October 2026, and names the outlet wherever a number comes from the press.
What gov.br and Serpro Datavalid are
The gov.br account is, in the government's words, a secure identification that proves in digital channels who is using a service. It is free for the citizen.[1] Datavalid is a service of Serpro, the Federal Data Processing Service, that validates the identity of people and companies by querying the original government databases through an API.[4]
gov.br
Brazil's citizen account, with Serpro Datavalid as the validation API for companies
Each level reflects how the account was proven. The table follows the text of the gov.br levels page.[1] That page does not list the national identity card (CIN); the CIN route in the gold row rests on the two press reports named there.
| Level | How the account reaches it | What it opens |
|---|---|---|
| Bronze | CPF or INSS (social security) data only, or in person at an INSS or Denatran office | Less sensitive digital services |
| Silver | Face biometrics against the driving licence (CNH), bank data through internet banking or an accredited bank, or the SIGEPE register of public servants | Many digital services |
| Gold | Face biometrics against the Electoral Justice (TSE) records, or a digital certificate compatible with ICP-Brasil.[1] The CIN also raises an account to gold, according to Agência Brasil,[6] through its QR code, according to Convergência Digital.[5] | Any digital service, with no restriction |
Adoption: how many people have gov.br
Two press figures quote the MGI. In December 2025 gov.br had about 172 million registered users, 77.8 million of them gold, according to Convergência Digital.[5] On 24 September 2026 it had more than 178 million users and more than 5,000 federal digital services, according to Agência Brasil.[6]
Gold accounts grew 142% between December 2022 and December 2025, according to Convergência Digital quoting the MGI.[5] Of the 64 million people who had been issued a CIN, 22 million had not yet used it to raise their account to gold, the MGI said on 24 September 2026, according to Agência Brasil.[6]
Note
Our sources give no share of adults and no transaction count. Gold accounts first passed bronze on 3 April 2025, according to TI Inside.[8]
What the user sees in a gov.br sign-in
The integration guide describes a redirect: the service shows a button that reads Entrar com gov.br and sends the user to gov.br in the phone's own browser, never an embedded web view. After sign-in and authorization the user comes back with a one-time code.[2]
Sign in to continue
Entrar com gov.br
1The service shows the Entrar com gov.br button.[2]
Sign in to gov.br
The user signs in on gov.br, not in your service.
2The user is redirected to gov.br and signs in there.[2]
Authorization page
Contents not described in the guide.
3gov.br redirects to its authorization page (illustration).[2]
You are signed in
- CPFShared
- NameShared
- Account levelShared
- Date of birthNot shared
- AddressNot shared
4Back in the service (illustration of the data it receives).[2]
Schematic screens, not screenshots of gov.br. The guide documents steps 1 and 2 and the redirect to an authorization page; screens 3 and 4 only illustrate that step and reproduce no documented gov.br screen.[2]
The guide documents one redirect and no separate cross-device flow.[2]
Datavalid has no screen of its own: the company builds the form and the selfie step, then calls the API.[4]
What a business receives from gov.br and Datavalid
This section describes what the two government services return, not a Didit product: gov.br is on Didit's roadmap and Didit does not offer it today. A gov.br sign-in returns an access token and an ID token. Every row comes from the integration guide.[2]
| Attribute | When it arrives | Detail |
|---|---|---|
| CPF | Always | 11 digits in the guide's example |
| Name | Always | The name registered in gov.br |
| Account level and seals | Always | Gold, silver or bronze, with seal ids and dates |
| Sign-in methods | Always | Password, digital certificate, bank, app QR code, second factor |
| Social name | Optional | Only when the user registered one |
| Email and phone | Optional | Each only when verified in gov.br |
| Photo | Optional | Read with the access token, in Base64 |
| CNPJ and company name | Optional | Only after sign-in with a company certificate |
| Date of birth, address | Never | Not documented fields |
With Datavalid, you send the customer's data, and it scores the match. Every row comes from the Datavalid service page on gov.br.[4]
| Mode | You send | You get back |
|---|---|---|
| Biographic | CPF or CNPJ number and status, identity document number and issuer, name, sex, date of birth, nationality, parents' names, driving-licence data | A similarity index for descriptive fields and true or false for objective fields |
| Biometric | A face photo, or one or more fingerprints | A similarity index and a probability band (low, high, very high). The service page names one base: the photos and fingerprints of the driving licence (CNH) |
| Document image | A picture of the document, from version 3 of Datavalid | Data extracted from the image and validated in the same call |
Watch out
Datavalid answers with scores and true or false flags, not a copy of the citizen's record.[4] The page's field list has no address, and the biometric answer is a score, not a portrait.
Legal standing, AML and data protection
The Datavalid service page lists four instruments as its legislation: Portaria Denatran nº 015/2016, Portaria MF nº 457 of 8 December 2016, Portaria RFB nº 167 of 14 April 2022 and Portaria RFB nº 220 of 20 September 2022.[4] Serpro states that it processes personal data in line with the LGPD, the data protection law.[3]
On the login side, the guide sets the life of the ID token at 60 seconds and says it must never be sent to an API.[2]
Not confirmed
This guide quotes no Banco Central do Brasil provision on customer due diligence: we could not verify one against the regulator's text by 5 October 2026. Neither the gov.br guide nor the Serpro pages say that a login or a Datavalid result satisfies anti-money laundering (AML) identification.[2][4] Confirm the rule with counsel.
How a business connects to Serpro Datavalid and gov.br
Datavalid is open to companies. The service page lists legal entities as contracting users, and Serpro's store names banks, retailers, insurers, ride apps and ID techs as its market.[4][3] The service page states one mandatory requirement: the contracting company's e-CNPJ digital certificate.[4]
The gov.br login differs. The integration guide addresses the public bodies that integrate the Login Único and points to a separate process for test and production credentials.[2] Our research carries an unverified note that private companies in general cannot use the gov.br login, so the answer on 5 October 2026 is: not confirmed. Check eligibility with the gov.br credential process first.
Direct contract
Serpro Datavalid
- Bought in the Serpro store with an e-CNPJ[4]
- Pay per validation, no setup or monthly fee[3]
- You build the capture flow
Login
gov.br sign-in
- OpenID Connect redirect with PKCE[2]
- Credentials issued through a gov.br process[2]
- Guide written for public bodies; private-company eligibility not confirmed
Through a provider
Verification service
- Document, face and screening checks
- Covers users with no Brazilian record
- The provider runs the capture flow
Contracting is self-service: buy in the Serpro store, contract in the customer area, then authenticate with the Consumer Key and Consumer Secret. The service page gives ten minutes on average after the signed contract is sent.[4]
Serpro says there is no minimum consumption, no monthly fee and no setup cost, and that the unit price falls as volume grows; the bands are in a table in the store.[3][4] The service page describes a trial: up to 30 days or 3,000 queries at no charge, if cancelled inside that limit.[4] Our sources describe no certification scheme for intermediaries.
Where the login route is open, it works like this.
The user signs in and authorizes the data
A simplified reading of the steps in the gov.br Login Único integration guide, as the page stood in October 2026.[2]
Use cases and the rules behind them
| Use case | What fits | Rule documented in our sources |
|---|---|---|
| KYC and AML onboarding | Datavalid data and face validation[4] | Serpro sells to banks and financial institutions; no AML provision confirmed[3] |
| Age checks | Datavalid validates a date of birth the user gave you.[4] The gov.br login does not return one.[2] | ECA Digital, Law No. 15,211/2025, enacted on 17 September 2025 and in force since 17 March 2026: reliable age verification, self-declaration no longer enough, according to Demarest[10] |
| Signing | The gov.br digital signature | gov.br has supported 370 million digital signatures, according to the World Bank; no signature law confirmed here[7] |
| Telecom, gambling | The same two services | Our sources document no sector-specific rule for telecom or gambling |
The data protection authority (ANPD) supervises the ECA Digital, and formal enforcement activities are scheduled to start in January 2027, according to Mayer Brown.[11] See also eID, wallets and age estimation compared.
Limits and fallbacks
- People without a driving licence. Datavalid's biometric mode compares against the photo and fingerprint base of the CNH.[4]
- Foreigners and non-residents. Our sources describe no route for someone who holds only a foreign passport.
- Minors. Our sources describe no gov.br or Datavalid route for minors.
Our sources record no outage history. The fallback is the document route: the identity document, NFC chip reading where the document carries a chip, a liveness check and a face match.
1Ask for the CPF and the country of the document
Does the user have a Brazilian record you can validate
Government-backed check first
gov.br sign-in where permitted, or data and face validation.
Verify with a document
Chip reading where present, liveness and face match.
2Screen and decide
Both paths end here: sanctions and PEP screening, then your decision.
Government check first, document route for the rest.
Implementation checklist
- Decide between a login (gov.br) and a validation (Datavalid).
- Get the company's e-CNPJ certificate first.[4]
- Test with the Datavalid simulator.[3]
- Collect the date of birth yourself: the gov.br login does not return it.[2]
- Where the gov.br login is open to you (private-company eligibility is not confirmed), use PKCE, validate the state value and check the token signature against the public key, per the guide.[2]
- Build the document route for everyone else.
How Didit helps with eID verification in Brazil
gov.br is on Didit's roadmap. What works in Brazil today is the document route: ID verification with chip reading where the document has a chip, passive liveness and face match, plus AML screening against 1,300+ sanctions, PEP and watchlists. A full KYC check costs $0.33 and AML screening costs $0.20 (see pricing).
Didit provides
- The document route in Brazil
- AML screening and ongoing monitoring
- The evidence of every check
Stays with you
- The risk assessment and the policies
- Any contract with Serpro or the gov.br team
- The onboarding decision
Key takeaways
- gov.br is a login with bronze, silver and gold levels; Serpro Datavalid is a pay-per-validation API.
- A gov.br sign-in returns the CPF, the name and the account level, with no date of birth and no address.
- Private-company access to the gov.br login and the AML provision are not confirmed as of 5 October 2026.
Frequently asked questions
What is Serpro Datavalid?
Datavalid is a Serpro API that validates the identity of people and companies against the original government databases. One mode scores the data you send; the other compares a face photo or fingerprints with the driving-licence base.[4]
How much does Serpro Datavalid cost?
Serpro bills per validation, with no minimum consumption, no monthly fee and no setup cost, and the unit price falls with volume.[3] The price bands are in a table in the Serpro store.[4]
Can a private company add the gov.br login to its website?
That is not confirmed as of 5 October 2026. The integration guide addresses public bodies, and our research carries an unverified note that private companies in general cannot use it. Check eligibility with the gov.br credential process first.[2]
What data does a gov.br sign-in return?
The CPF, the registered name, the account level and the sign-in methods used. Email, phone and photo arrive only when present or verified. The documented fields include no date of birth and no address.[2]
What do bronze, silver and gold mean on gov.br?
Bronze is CPF or INSS data, silver adds face biometrics against the driving licence or bank data, and gold comes from face biometrics against the Electoral Justice records or an ICP-Brasil certificate.[1] The CIN also raises an account to gold, according to Agência Brasil.[6] Our sources map them to no eIDAS level.
Does gov.br or Datavalid satisfy AML customer due diligence in Brazil?
We could not confirm that from the regulator's own text by 5 October 2026. Neither the gov.br guide nor the Serpro pages claim it.[2][4] Check the rule for your licence with counsel.
Can foreigners and minors be verified with gov.br or Datavalid?
Eligibility for these groups is not established by the sources reviewed. The Datavalid service page names the driving-licence base for its face check.[1][4] Plan a document check for these users.
How long does a Datavalid integration take, and can I test first?
About ten minutes on average after the signed contract is sent, according to the service page, and the contract needs an e-CNPJ certificate.[4] You can test first: there is a simulator, and a trial of up to 30 days or 3,000 queries if cancelled inside that limit.[3][4]
Sources
- Nível prata ou ouro, gov.br, Portal do Empreendedor, the three account levels.
- Passo-a-Passo para Integrar, Roteiro de Integração do Login Único, gov.br.
- Datavalid, Loja Serpro, product page.
- Obter solução digital para validação de identidade (Datavalid), gov.br service page of Serpro, last modified 15 December 2025.
- Gov.br registra 77,8 milhões de contas ouro, Convergência Digital, 18 December 2025, quoting the MGI.
- Carteira de Identidade Nacional possibilita ter conta ouro no GOV.BR, Agência Brasil, 24 September 2026, quoting the MGI.
- Building trust through digital transformation in Brazil, World Bank Blogs.
- GOV.BR: número de contas Ouro supera o de Bronze pela primeira vez, TI Inside, 3 April 2025.
- Vinte milhões de brasileiros já têm Carteira de Identidade Nacional, Agência Brasil, February 2025.
- Digital Statute for Children and Adolescents, Law No. 15,211/2025, Demarest, 18 March 2026.
- Enforcement of Brazil's ECA Digital introduces new obligations for companies, Mayer Brown, April 2026.
Compare gov.br with other national schemes on the eID verification page, and see the EUDI Wallet page for European users.
One workflow for Brazil and everywhere else
Start with the document route.
Related articles
- Cl@ve integration in Spain: who can connect and what to use instead
- PhilSys verification: how businesses check the National ID
- OpenID4VP verifier guide: accepting the EUDI Wallet
- eIDAS regulation explained: what eIDAS 2 (2024/1183) changes
- Smart-ID API: a developer's guide to RP API v3
- National digital identity worldwide: models, leaders, standards