Ersetze Sicherheitsfragen und SMS-Einmalcodes durch einen biometrischen Abgleich mit dem Registrierungs-Selfie. Ergebnis in unter 2 Sekunden, ca. 0,15 $ pro Wiederherstellung, iBeta Level 1 zertifiziert.
Robinhood Ventures
Über 2.000 Organisationen weltweit vertrauen uns.
Warum ein Face Check besser ist als SMS
SIM-Swapping hebelt SMS-Einmalcodes aus. Phishing hebelt Sicherheitsfragen aus. Support-Mitarbeiter scheitern unter Druck. Ein Live-Gesichtsabgleich mit dem Registrierungs-Selfie besiegt alle drei, für $0.15 pro Wiederherstellung, mit einem Ergebnis in unter zwei Sekunden und 500 kostenlosen Checks pro Monat.
Wähle die gewünschten Checks aus, ID, Liveness, Face Match, Sanktionen, Adresse, Alter, Telefon, E-Mail, benutzerdefinierte Fragen. Ziehe sie im Dashboard in einen Flow oder poste denselben Flow an unsere API. Verzweige nach Bedingungen, führe A/B-Tests durch, kein Code erforderlich.
Bette nativ mit unserem Web-, iOS-, Android-, React Native- oder Flutter-SDK ein. Leite auf eine gehostete Seite weiter. Oder sende deinem User einfach einen Link, per E-Mail, SMS, WhatsApp, überall. Wähle, was zu deinem Stack passt.
Didit hostet die Kamera, die Lichtsignale, die mobile Übergabe und die Barrierefreiheit. Während der User den Flow durchläuft, bewerten wir über 200 Betrugssignale in Echtzeit und verifizieren jedes Feld anhand autoritativer Datenquellen. Ergebnis in unter zwei Sekunden.
Echtzeit-signierte Webhooks halten deine Datenbank synchron, sobald ein User genehmigt, abgelehnt oder zur Überprüfung gesendet wird. Frage die API bei Bedarf ab. Oder öffne die Konsole, um jede Session, jedes Signal zu prüfen und Fälle nach deinen Wünschen zu verwalten.
Didit · Face Match 1:1
Enrolment
Recovery
Didit · Passive Liveness
Didit · Step-up policy
Didit · Fallbacks
Didit · Audit log
Didit · Session policy
$ curl -X POST https://verification.didit.me/v3/session/ \
-H "x-api-key: $DIDIT_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"workflow_id": "wf_account_recovery",
"vendor_data": "user-7382",
"metadata": { "trigger": "forgot_password" },
// base64 enrolment selfie, ≤ 1MB
"portrait_image": "/9j/4AAQSkZJRgABAQE..."
}'status: Approved meldet.Doku →// X-Signature-V2 verified upstream
if (payload.status === "Approved") {
sendPasswordResetEmail(payload.vendor_data);
registerNewDevice(payload.metadata);
} else if (payload.status === "Declined") {
security.logRecoveryAttack(payload);
}X-Signature-V2, bevor du den Payload liest.Doku →You are integrating Didit into an account-recovery flow. Replace knowledge-based recovery (security questions, SMS OTP, support-rep verification) with a biometric re-match against the user's enrolment selfie. ONE Didit session, two checks:
- Passive Liveness — make sure the recovery selfie is a real human, not a print / screen / mask / deepfake.
- Face Match 1:1 — match the recovery selfie against the user's enrolment selfie. If similarity is above your threshold, the recovery is approved.
Bundle pricing (verified live, 2026-05-16):
- Passive Liveness: $0.10 per recovery
- Face Match 1:1: $0.05 per recovery
- Total: ~$0.15 per recovery — public price, no minimums
- First 500 verifications free every month, forever
- SMS / WhatsApp One-Time Passcode (OTP) fallback: $0.03 per OTP (when biometric isn't possible)
PRE-REQUISITES
- Production API key from https://business.didit.me (sandbox key in 60s, no card).
- Webhook endpoint with HMAC SHA-256 verification using the X-Signature-V2 header.
- User's enrolment selfie on file — captured during initial KYC via a previous /v3/session/. Stored under your tenant in encrypted form.
- A workflow_id from the Workflow Builder that runs Passive Liveness + Face Match 1:1 against the stored reference.
STEP 1 — Trigger recovery on the right signal
Recovery is gated by your risk policy. Typical triggers:
- User clicks "Forgot password" — always.
- Sign-in from a new device + new IP country at the same time.
- Sign-in after account dormancy (e.g. 180+ days).
- Sensitive action: large withdrawal, payout to a new beneficiary, account-settings change.
Each trigger opens a Didit session.
STEP 2 — Open the recovery session
POST https://verification.didit.me/v3/session/
Headers:
x-api-key: <your api key>
Content-Type: application/json
Body:
{
"workflow_id": "<wf id with Passive Liveness + Face Match against enrolment selfie>",
"vendor_data": "<your user id, max 256 chars>",
"callback": "https://<your-app>/account/recovery/callback",
"metadata": {
"trigger": "forgot_password",
"device_fingerprint": "<your device fingerprint>",
"ip_country": "ES"
},
"portrait_image": "<base64 JPEG of the user's enrolment selfie, ≤ 1 MB — REQUIRED when the workflow has FACE_MATCH active; the recovery flow matches the new live selfie against this stored reference>"
}
Response: 201 Created with a hosted session URL. Redirect the user (web or in-app webview) to the URL. Sub-2-second median verdict on completion.
STEP 3 — Read the signed webhook on the verdict
Didit POSTs to your callback. Session statuses are Title Case With Spaces:
Body (excerpted):
{
"session_id": "<uuid>",
"vendor_data": "<your user id>",
"status": "Approved",
"liveness": { "status": "Approved" },
"face": { "status": "Approved", "similarity_score": 0.94 }
}
Status enum (exact case): Approved | Declined | In Review | Resubmitted | Expired | Not Finished | Kyc Expired | Abandoned.
Verify the X-Signature-V2 header BEFORE reading the body — HMAC SHA-256 of the raw bytes with your webhook secret.
STEP 4 — Branch on the verdict
Approved → unlock recovery: send the password-reset email, register the new device, complete the sensitive action.
In Review → soft-fail the recovery, route to support for human review.
Declined → block the recovery; log the hit. Could be a printed-photo or screen-replay attack — surface to security.
Resubmitted → user retried after a soft rejection — re-read.
Kyc Expired → reference selfie has aged out (per your retention policy) — fall back to documented recovery flow.
STEP 5 — Fallback for users who can't take a selfie
Camera missing, low light, hardware refused permission. Two graceful fallbacks:
- SMS / WhatsApp / Telegram One-Time Passcode (OTP) via Didit Phone Verification, $0.03 per OTP.
- Email magic link via your existing transactional email provider, $0.03 per email.
- Authenticator app — Time-based One-Time Password (TOTP) or FIDO2 hardware key, free.
Configure the fallback chain in the Workflow Builder. Selfie always tried first.
WEBHOOK EVENT NAMES
- Sessions: status changes flow through the standard session webhook.
Verify X-Signature-V2 on every payload.
CONSTRAINTS
- Session statuses use Title Case With Spaces (Approved, In Review). Do not lowercase or snake_case them.
- The recovery similarity threshold is configurable per app — start at 0.85, tune up for high-assurance apps (banks, brokerages) and down for low-friction consumer apps.
- Liveness is a Presentation Attack Detection (PAD) Level 1 model — defeats prints, screens, masks, deepfakes on consumer cameras. Active liveness (head-tilt prompts) is available for higher-friction higher-assurance flows at $0.15.
- The user's enrolment selfie must have been captured by Didit (any prior /v3/session/ with face capture). Bring-your-own enrolment image is roadmap.
- Default audit retention is 5 years configurable in the Business Console.
Read the docs:
- https://docs.didit.me/sessions-api/create-session
- https://docs.didit.me/core-technology/face-match/overview
- https://docs.didit.me/core-technology/liveness/overview
- https://docs.didit.me/integration/webhooks
Start free at https://business.didit.me — sandbox key in 60 seconds, 500 verifications free every month, no credit card.$0 / Monat. Keine Kreditkarte erforderlich.
Zahle nur, was du nutzt. Über 25 Module. Öffentliche Preise pro Modul, keine monatliche Mindestgebühr.
Individuelle MSA & SLA. Für große Volumina und regulierte Programme.
Kostenlos starten → nur zahlen, wenn eine Prüfung läuft → Enterprise für einen individuellen Vertrag, SLA oder Datenresidenz freischalten.
Didit is infrastructure for identity and fraud, the platform we wished existed when we were building products ourselves: open, flexible, and developer-friendly, so it works as a real part of your stack instead of a black box you integrate around.
One API covers verifying people (KYC, know your customer), verifying businesses (KYB, know your business), screening crypto wallets (KYT, know your transaction), and monitoring transactions in real time, on a stack built to be:
The footprint underneath: 14,000+ document types in 48+ languages, 1,000+ data sources, and 200+ fraud signals on every session. The Didit infrastructure dynamically learns from every session and gets better every day.
Because the recovery flow is the easiest place to bypass authentication. The user has forgotten the password, by definition you can't ask for it. Most apps fall back to:
A live face match against the enrolment selfie defeats all four.
Three structural problems that won't go away:
The US National Institute of Standards and Technology (NIST) has explicitly recommended against SMS for high-assurance recovery since 2017 (SP 800-63B).
The full flow normally takes under 30 seconds end-to-end, pick up the ID, snap the document, snap the selfie, done. That is the fastest in the market. Legacy KYC providers usually take more than 90 seconds for the same flow.
On the back end, Didit returns the result in under two seconds at p99, measured from the moment the user finishes the selfie to the moment your webhook fires. Mobile capture is tuned for slow phones and slow networks: progressive image compression, lazy software development kit load, and a one-tap hand-off from desktop to phone via QR code if the user starts on web.
Two scenarios:
Bring-your-own enrolment image, your existing selfie corpus, is on the roadmap.
Every session lands on one of seven clear statuses, so your code always knows what to do:
Approved, every check passed. Move the user forward.Declined, one or more checks failed. You can allow the user to resubmit the specific failed step (for example, re-take the selfie) without re-running the whole flow.In Review, flagged for compliance review. Open the case in the console, see every signal, decide approve or decline.In Progress, user is mid-flow.Not Started, link sent, user has not opened it yet. Send a reminder if it sits too long.Abandoned, user opened the link but did not finish in time. Re-engage or expire.Expired, the session link aged out. Create a new session.A signed webhook fires on every status change, so your database always stays in sync. Abandoned and declined sessions are free.
Production data is processed and stored in the European Union by default, on Amazon Web Services. Enterprise contracts can request alternative regions for jurisdictions whose regulators require it.
Encryption everywhere. AES-256 at rest across every database, object store, and backup. Transport Layer Security 1.3 in transit on every API call, webhook, and Business Console session. Biometric data is encrypted under a separate Customer Master Key.
Retention is yours to control. Default retention is indefinite (unlimited) unless you configure shorter, between 30 days and 10 years per application, and you can delete any individual session at any time from the dashboard or the API.
Certifications: SOC 2 Type 1 (Type 2 audit in progress), ISO/IEC 27001:2022, iBeta Level 1 PAD, and a public attestation from Spain''s Tesoro / SEPBLAC / CNMV that Didit''s remote identity verification is safer than verifying someone in person. Full report at /security-compliance.
Didit ships compliant by default for the regulators that matter to identity infrastructure:
Detailed memo, every certificate, every regulator letter: /security-compliance.
Three integration paths, pick whichever fits your stack:
Same dashboard, same billing, same pay-per-success price for all three. Step-by-step guide at docs.didit.me/integration/integration-prompt.
Passive Liveness defeats consumer-grade deepfakes today. The Presentation Attack Detection (PAD) model looks for:
Didit's PAD model is iBeta Level 1 certified. Active Liveness ($0.15) adds head-tilt prompts for higher assurance against the rare professional-grade real-time deepfake.
Deepfake defence is an arms race, Didit retrains the PAD model on a quarterly cadence against the latest attack corpora.
Yes, that's Biometric Authentication, a recurring re-auth pattern. $0.10 per auth:
Same /v3/session/ contract, different workflow_id. Common for crypto exchanges, banking apps, and high-assurance consumer products. See /products/biometric-authentication for the recurring-auth pattern.
Every recovery attempt logs:
vendor_data (your user identifier) and Didit session_id.trigger you passed in metadata (forgot_password / new_device / dormancy / sensitive_action).Searchable from the Business Console, exportable per user, 5-year retention configurable. SOC 2 Type 1 + ISO 27001 controls govern the storage.
Eine API für KYC, KYB, Transaktionsüberwachung und Wallet-Screening. In 5 Minuten integriert.