बायोमेट्रिक ऑथेंटिकेशन ($0.10) और डिवाइस व IP एनालिसिस ($0.03) एक ही प्रॉम्प्ट में दो PSD3-ग्रेड SCA फैक्टर प्रदान करते हैं। फ़िशिंग-रेज़िस्टेंट। SMS वन-टाइम-पासवर्ड के लिए ड्रॉप-इन रिप्लेसमेंट।
Robinhood Ventures
दुनिया भर में 2,000+ संगठनों द्वारा विश्वसनीय।
SMS OTP क्यों बंद हो रहा है
PSD3, SMS वन-टाइम-पासवर्ड को स्ट्रॉन्ग कस्टमर ऑथेंटिकेशन फैक्टर के तौर पर हटा रहा है। Didit का डिवाइस-बाउंड बायोमेट्रिक SCA SIM-स्वैप, रियल-टाइम फ़िशिंग और SS7 इंटरसेप्शन को रोकता है, $0.13 प्रति ऑथेंटिकेशन पर, दो सेकंड से भी कम समय में परिणाम, डायनामिक-लिंकिंग के लिए तैयार। हर महीने 500 वेरिफिकेशन मुफ्त।
अपनी ज़रूरत के चेक चुनें, ID, लाइवनैस, फ़ेस मैच, सैंक्शन, एड्रेस, उम्र, फ़ोन, ईमेल, कस्टम सवाल। उन्हें डैशबोर्ड में एक फ़्लो में ड्रैग करें, या उसी फ़्लो को हमारे API पर पोस्ट करें। शर्तों के आधार पर ब्रांच करें, A/B टेस्ट चलाएँ, किसी कोड की ज़रूरत नहीं।
हमारे वेब, iOS, Android, React Native, या Flutter SDK के साथ नेटिवली एम्बेड करें। होस्ट किए गए पेज पर रीडायरेक्ट करें। या बस अपने यूज़र को एक लिंक भेजें, ईमेल, SMS, WhatsApp, कहीं भी। जो आपके स्टैक के लिए सही हो, उसे चुनें।
Didit कैमरा, लाइटिंग क्यू, मोबाइल हैंड-ऑफ़ और एक्सेसिबिलिटी को होस्ट करता है। जब यूज़र फ़्लो में होता है, तो हम रियल टाइम में 200+ फ़्रॉड सिग्नल स्कोर करते हैं और हर फ़ील्ड को आधिकारिक डेटा स्रोतों के ख़िलाफ़ वेरिफाई करते हैं। दो सेकंड से भी कम समय में परिणाम।
रियल-टाइम साइंड वेबहुक आपके डेटाबेस को सिंक में रखते हैं, जैसे ही कोई यूज़र अप्रूव होता है, डिक्लाइन होता है, या रिव्यू के लिए भेजा जाता है। ज़रूरत पड़ने पर API को पोल करें। या हर सेशन, हर सिग्नल की जाँच करने और अपने तरीके से मामलों को मैनेज करने के लिए कंसोल खोलें।
Didit · SCA factors
Knowledge
Password · PIN
Optional
Possession
Bound device
Didit ✓
Inherence
Face · liveness
Didit ✓
Didit · Dynamic linking
Didit · Attack matrix
Didit · Exemption engine
Didit · Device & IP Analysis
Didit · Per-auth cost
$ curl -X POST https://verification.didit.me/v3/session/ \
-H "x-api-key: $DIDIT_API_KEY" \
-d '{
"workflow_id": "wf_sca_biometric",
"vendor_data": "user-42",
"metadata": { "purpose": "login" },
// base64 KYC enrolment selfie, ≤ 1MB
"portrait_image": "/9j/4AAQSkZJRgABAQE..."
}'स्टेटस अप्रूव्ड · डिक्लाइंड · इन रिव्यू$ curl -X POST https://verification.didit.me/v3/session/ \
-H "x-api-key: $DIDIT_API_KEY" \
-d '{
"workflow_id": "wf_sca_biometric",
"vendor_data": "user-42",
"metadata": { "amount": "247.50", "payee_account": "ES91…1332" },
// base64 KYC enrolment selfie, ≤ 1MB
"portrait_image": "/9j/4AAQSkZJRgABAQE..."
}'वेबहुक सत्यापन के लिए राशि + प्राप्तकर्ता को दोहराता हैYou are integrating Didit's Strong Customer Authentication into a payment service provider, bank, EMI, or wallet to satisfy PSD3 / the Payment Services Regulation (PSR). Two factors in one prompt:
1. Inherence — Biometric Authentication: Passive Liveness + Face Match 1:1 against the user's previously-enrolled KYC selfie.
2. Possession — Device & IP Analysis: 200+ real-time fraud signals binding the auth to the user's known device.
Pricing (verified live 2026-05-16):
- Biometric Authentication: $0.10 per auth
- Device & IP Analysis: $0.03 per auth
- Total: $0.13 per Strong Customer Authentication
- First 500 verifications free every month, forever
- Re-uses the enrolled selfie from the original KYC — no re-enrolment
PRE-REQUISITES
- Production API key from https://business.didit.me (sandbox key in 60 seconds, no credit card).
- Webhook endpoint with HMAC SHA-256 verification of the X-Signature-V2 header.
- A workflow_id from the no-code Workflow Builder configured as a Biometric Authentication workflow (Passive Liveness + Face Match 1:1 + Device & IP Analysis).
- The user has previously completed a Didit KYC (the same enrolled selfie backs every subsequent auth).
STEP 1 — Open an authentication session
POST https://verification.didit.me/v3/session/
Headers:
x-api-key: <your api key>
Content-Type: application/json
Body (for login auth):
{
"workflow_id": "<wf id for SCA biometric auth>",
"vendor_data": "<your user id>",
"callback": "https://<your-app>/auth/callback",
"metadata": {
"purpose": "login",
"session_id": "<your front-end session id>"
},
"portrait_image": "<base64 JPEG of the user's KYC enrolment selfie, ≤ 1 MB — REQUIRED for SCA's inherence factor; OMIT only if the workflow is liveness-only>"
}
Body (for payment with dynamic linking):
{
"workflow_id": "<wf id for SCA biometric auth>",
"vendor_data": "<your user id>",
"callback": "https://<your-app>/payment/callback",
"metadata": {
"purpose": "payment",
"amount": "247.50",
"currency": "EUR",
"payee_account": "ES9121000418450200051332",
"payee_name": "<merchant or recipient>",
"transaction_reference": "<your internal transaction id>"
},
"portrait_image": "<base64 JPEG of the user's KYC enrolment selfie, ≤ 1 MB — REQUIRED for SCA's inherence factor>"
}
Response: 201 Created with the hosted session URL. Push the URL to the user via deep-link / push notification / in-app sheet.
STEP 2 — User completes the biometric auth
The user sees one prompt on their phone (or via the Didit SDK in your native app). Three things happen on the same screen:
1. The amount + payee are displayed (dynamic linking — the user explicitly approves THIS amount to THIS payee for payments).
2. Passive Liveness defeats screen replay, printed photo, mask, deepfake.
3. Face Match 1:1 matches the new selfie against the enrolled KYC selfie.
Device & IP Analysis runs server-side on the session. Sub-2-second median verdict.
STEP 3 — Read the signed webhook on the auth verdict
Didit POSTs to your callback. Session statuses (Title Case With Spaces):
Body (excerpted):
{
"session_id": "<uuid>",
"vendor_data": "<your user id>",
"status": "Approved",
"liveness": { "status": "Approved" },
"face": { "status": "Approved", "similarity_score": 0.94 },
"ip_analysis": { "status": "Approved", "vpn_detected": false, "datacenter_ip": false },
"metadata_echo": {
"amount": "247.50",
"payee_account": "ES9121000418450200051332"
}
}
Status enum (exact case): Approved | Declined | In Review | Resubmitted | Expired | Not Finished | Kyc Expired | Abandoned.
Verify the X-Signature-V2 header BEFORE reading the body — HMAC SHA-256 of the raw bytes with your webhook secret.
For payments, verify that metadata_echo.amount and metadata_echo.payee_account match the values you passed in. If they do not, REJECT the payment — it's a dynamic-linking violation.
STEP 4 — Branch on verdict
Approved → unlock the action (login, payment, account change).
In Review → hold the action, route to manual review queue.
Declined → block, log the attempt, surface a friendly "try again" to the user.
Resubmitted → the user re-submitted after a soft fail (poor lighting, occlusion); proceed if the latest status is Approved.
STEP 5 — Retrieve the full decision later
GET https://verification.didit.me/v3/session/{sessionId}/decision/
Headers:
x-api-key: <your api key>
Returns the full payload: liveness verdict (iBeta Level 1 anti-spoof certified), Face Match similarity score, device fingerprint, IP geolocation, VPN / proxy / datacenter flags, 200+ fraud-signal score, dynamic-linking echo, HMAC signature.
Use this for the audit-trail surface a regulator examines on Strong Customer Authentication coverage.
STEP 6 — Step up on risk
When Device & IP Analysis surfaces a high-risk signal (new device + high-value payment, VPN/proxy on a login, geolocation jump), your workflow can step up to:
- A separate hardware-key challenge (FIDO2 / WebAuthn)
- A trusted-beneficiary whitelist confirmation
- A manual-review hold
Encode the step-up policy in the no-code Workflow Builder — no redeploy required.
WEBHOOK EVENT NAMES
- Sessions: status changes flow through the standard session webhook.
Verify X-Signature-V2 on every payload.
CONSTRAINTS
- Session statuses use Title Case With Spaces. Never UPPER_SNAKE_CASE on a session.
- Dynamic linking is REQUIRED for payments — pass amount + payee in metadata, verify the echo on the webhook.
- The enrolled selfie that backs every SCA is the one captured during the user's original KYC — no separate enrolment step.
- PSD3 / PSR exemptions (low-value remote < EUR 30, contactless point-of-sale < EUR 50, recurring identical, trusted beneficiary, Transaction Risk Analysis tiers) are configured per workflow in the Business Console.
- Default record retention is 5 years per the EU AML and payments rules.
Read the docs:
- https://docs.didit.me/sessions-api/create-session
- https://docs.didit.me/sessions-api/retrieve-session
- https://docs.didit.me/integration/webhooks
Start free at https://business.didit.me — sandbox key in 60 seconds, 500 verifications free every month, no credit card.$0 / महीना। क्रेडिट कार्ड की ज़रूरत नहीं।
आप जितना उपयोग करते हैं, केवल उसी का भुगतान करें। 25+ मॉड्यूल। प्रति-मॉड्यूल सार्वजनिक मूल्य निर्धारण, कोई मासिक न्यूनतम शुल्क नहीं।
कस्टम MSA और SLA। बड़ी मात्रा और विनियमित कार्यक्रमों के लिए।
मुफ़्त में शुरू करें → केवल चेक चलने पर भुगतान करें → कस्टम कॉन्ट्रैक्ट, SLA, या डेटा रेज़िडेंसी के लिए एंटरप्राइज़ अनलॉक करें।
Didit is infrastructure for identity and fraud, the platform we wished existed when we were building products ourselves: open, flexible, and developer-friendly, so it works as a real part of your stack instead of a black box you integrate around.
One API covers verifying people (KYC, know your customer), verifying businesses (KYB, know your business), screening crypto wallets (KYT, know your transaction), and monitoring transactions in real time, on a stack built to be:
The footprint underneath: 14,000+ document types in 48+ languages, 1,000+ data sources, and 200+ fraud signals on every session. The Didit infrastructure dynamically learns from every session and gets better every day.
Strong Customer Authentication (SCA) is a rule from the EU's payment-services regulation that says: when a customer logs in to their account or initiates a payment, you must verify them using at least two of three independent factor categories.
The three categories:
The two factors must come from different categories, a password plus a security question is not SCA, because both are knowledge. A password plus a fingerprint is, because they cross categories.
A third requirement, dynamic linking, says the second factor for a payment must be tied uniquely to the transaction amount and payee, so a stolen code cannot be replayed against a different transaction.
PSD3, short for Payment Services Directive 3, is the EU's 2026 rewrite of the rulebook PSD2 introduced in 2018. Alongside it sits the Payment Services Regulation (PSR) which is directly applicable across member states without national transposition.
Key changes over PSD2:
Transition is rolling, most SCA changes are expected to take effect 18 to 24 months after final adoption.
The full flow normally takes under 30 seconds end-to-end, pick up the ID, snap the document, snap the selfie, done. That is the fastest in the market. Legacy KYC providers usually take more than 90 seconds for the same flow.
On the back end, Didit returns the result in under two seconds at p99, measured from the moment the user finishes the selfie to the moment your webhook fires. Mobile capture is tuned for slow phones and slow networks: progressive image compression, lazy software development kit load, and a one-tap hand-off from desktop to phone via QR code if the user starts on web.
Need SCA by default:
Exempt (PSD3 keeps most PSD2 exemptions but tightens the thresholds):
Getting the exemption math right is the highest-leverage SCA optimisation work most teams do, applied well it drops auth friction without raising fraud.
Every session lands on one of seven clear statuses, so your code always knows what to do:
Approved, every check passed. Move the user forward.Declined, one or more checks failed. You can allow the user to resubmit the specific failed step (for example, re-take the selfie) without re-running the whole flow.In Review, flagged for compliance review. Open the case in the console, see every signal, decide approve or decline.In Progress, user is mid-flow.Not Started, link sent, user has not opened it yet. Send a reminder if it sits too long.Abandoned, user opened the link but did not finish in time. Re-engage or expire.Expired, the session link aged out. Create a new session.A signed webhook fires on every status change, so your database always stays in sync. Abandoned and declined sessions are free.
Production data is processed and stored in the European Union by default, on Amazon Web Services. Enterprise contracts can request alternative regions for jurisdictions whose regulators require it.
Encryption everywhere. AES-256 at rest across every database, object store, and backup. Transport Layer Security 1.3 in transit on every API call, webhook, and Business Console session. Biometric data is encrypted under a separate Customer Master Key.
Retention is yours to control. Default retention is indefinite (unlimited) unless you configure shorter, between 30 days and 10 years per application, and you can delete any individual session at any time from the dashboard or the API.
Certifications: SOC 2 Type 1 (Type 2 audit in progress), ISO/IEC 27001:2022, iBeta Level 1 PAD, and a public attestation from Spain''s Tesoro / SEPBLAC / CNMV that Didit''s remote identity verification is safer than verifying someone in person. Full report at /security-compliance.
Didit ships compliant by default for the regulators that matter to identity infrastructure:
Detailed memo, every certificate, every regulator letter: /security-compliance.
Three integration paths, pick whichever fits your stack:
Same dashboard, same billing, same pay-per-success price for all three. Step-by-step guide at docs.didit.me/integration/integration-prompt.
Same POST /v3/session/ API on every surface, the user-facing capture differs:
The same biometric template the user enrolled at KYC time backs every auth, no re-enrolment, no separate flow.
Yes, the same auth bundle satisfies most equivalent global rules:
One API, one auth bundle, every jurisdiction. The exemption math changes; the technical contract does not.
Every authentication produces a signed evidence record exportable from the Business Console:
Pending to Approved or Declined, with reviewer notes if escalatedAll records stored in the European Union (EU data centres), retained indefinitely while your subscription is active. Default record retention is 5 years per the EU AML and payments rules, extensible per your supervisor's guidance.
KYC, KYB, ट्रांज़ैक्शन मॉनिटरिंग और वॉलेट स्क्रीनिंग के लिए एक API। 5 मिनट में इंटीग्रेट करें।