$0.33 first visit, $0.10 every return, face at the door, age enforced per category, no staff. 500 verifications free every month.
Robinhood Ventures
Trusted by 2,000+ organizations worldwide.
What unstaffed retail owes
Unstaffed convenience stores, vending pods, smart fridges, autonomous fuel, they all owe the same compliance as a staffed store: real ID, real age, real audit trail. Didit ships it as one workflow: $0.33 first visit, $0.10 every return, sub-2-second median verdict, 14,000+ documents across 220+ countries.
Pick the checks you want, ID, liveness, face match, sanctions, address, age, phone, email, custom questions. Drag them into a flow in the dashboard, or post the same flow to our API. Branch on conditions, run A/B tests, no code required.
Embed natively with our Web, iOS, Android, React Native, or Flutter SDK. Redirect to a hosted page. Or just send your user a link, by email, SMS, WhatsApp, anywhere. Pick what fits your stack.
Didit hosts the camera, the lighting cues, the mobile hand-off, and accessibility. While the user is in the flow, we score 200+ fraud signals in real time and verify every field against authoritative data sources. Result in under two seconds.
Real-time signed webhooks keep your database in sync the moment a user is approved, declined, or sent to review. Poll the API on demand. Or open the console to inspect every session, every signal, and manage cases your way.
Didit · Entry flow
Step 3 / 4
Door unlocking…
Didit · Age gate
Didit · Biometric Auth
Didit · Attempt log
Shopper
Entry
Didit · Category policy
Didit · Ecosystem
$ curl -X POST https://verification.didit.me/v3/session/ \
-H "x-api-key: $DIDIT_API_KEY" \
-d '{
"workflow_id": "wf_store_entry_kyc",
"vendor_data": "shopper-42",
"metadata": { "store_id": "store_sf_12" }
}'status: Approved.docs →$ curl -X POST https://verification.didit.me/v3/session/ \
-H "x-api-key: $DIDIT_API_KEY" \
-d '{
"workflow_id": "wf_store_entry_biometric",
"vendor_data": "shopper-42",
// base64 first-visit selfie, ≤ 1MB (omit for liveness-only)
"portrait_image": "/9j/4AAQSkZJRgABAQE..."
}'You are integrating Didit into an autonomous-retail surface — an unstaffed convenience store, an age-gated vending machine, a smart fridge, an autonomous fuel station, or a self-checkout that handles restricted SKUs. The recipe verifies identity + age at entry and authenticates returning shoppers via face only.
Three pillars:
1. First visit — verify the shopper's identity and age with one POST /v3/session/ ($0.33 bundle).
2. Returning visit — Biometric Authentication at $0.10 per entry. Shopper holds their face to the door camera; door unlocks.
3. Per-SKU enforcement — block restricted categories (alcohol, tobacco, vapes, energy drinks, RX) at scan or checkout based on the verified age and the store's local rules.
Cost:
- First visit KYC bundle: $0.33 per shopper (Sessions API)
- Returning visit Biometric Auth: $0.10 per entry
- First 500 verifications free every month, forever
PRE-REQUISITES
- Production API key from https://business.didit.me (sandbox key in 60s, no card).
- Webhook endpoint with HMAC SHA-256 verification using the X-Signature-V2 header and your webhook secret.
- Two workflows in the Workflow Builder:
wf_store_entry_kyc — ID Verification + Passive Liveness + Face Match 1:1 + age rules (first visit)
wf_store_entry_biometric — Biometric Auth-only (returning visit)
- A store-id + local-rule lookup so age thresholds vary per region (EU 18 vs US 21 for alcohol; state-by-state tobacco; dry counties; etc.).
STEP 1 — First visit: verify the shopper
POST https://verification.didit.me/v3/session/
Headers:
x-api-key: <your api key>
Content-Type: application/json
Body:
{
"workflow_id": "<wf_store_entry_kyc>",
"vendor_data": "<your shopper id, max 256 chars>",
"callback": "https://<your-app>/store/entry/callback",
"metadata": {
"purpose": "autonomous_store_entry",
"store_id": "<your store id>",
"region": "<US-CA | EU-ES | etc.>"
}
}
Response: 201 Created with the hosted session URL. Encode that URL in the QR sticker on the door (or push it to the shopper's phone via SMS / WhatsApp). Sub-2-second median verdict on completion.
STEP 2 — Read the signed webhook on entry-flow completion
Didit POSTs to your callback. Session statuses are Title Case With Spaces:
Body (excerpted):
{
"session_id": "<uuid>",
"vendor_data": "<your shopper id>",
"status": "Approved",
"id_verification": {
"status": "Approved",
"date_of_birth": "1991-04-22",
"country": "US"
},
"liveness": { "status": "Approved" },
"face": { "status": "Approved", "similarity_score": 0.94 }
}
Status enum (exact case): Approved | Declined | In Review | Resubmitted | Expired | Not Finished | Kyc Expired | Abandoned.
Verify the X-Signature-V2 header BEFORE reading the body — HMAC SHA-256 of the raw bytes with your webhook secret.
Compute the age from date_of_birth, look up the region's age thresholds (per category), and store the (shopper_id, age_band, region, kyc_status) tuple in your data layer.
STEP 3 — Open the door
When status is Approved, signal your store-OS / door-controller to unlock. Median wall-clock from QR scan to door open is around 1.4 seconds on entry-level Android, sub-2 seconds end to end.
Failure modes to handle:
Declined / In Review / Resubmitted — show a friendly UI on the kiosk and offer staff hand-off.
Expired / Abandoned — shopper walked away; do nothing, the session expires.
STEP 4 — Returning visit: Biometric Authentication
POST https://verification.didit.me/v3/session/
Body:
{
"workflow_id": "<wf_store_entry_biometric>",
"vendor_data": "<your shopper id>",
"metadata": {
"purpose": "autonomous_store_entry_return",
"store_id": "<your store id>"
}
}
The shopper just holds their face to the door camera. Cost is $0.10 per entry. Same webhook flow.
STEP 5 — Read the decision on demand
GET https://verification.didit.me/v3/session/{sessionId}/decision/
Headers:
x-api-key: <your api key>
Returns the full decision JSON. Use this from the POS / self-checkout when the shopper picks up a restricted SKU — confirm age + region match the SKU's rules before letting the basket close.
STEP 6 — Per-SKU enforcement at checkout
Inside your POS / store-OS, every restricted SKU carries a category tag (alcohol, tobacco, vape, energy-drink, sharp-tool, RX). Look up the shopper's verified age band + the store's region rules. Examples:
Alcohol US-21 / EU-18, blocked in dry counties, time-of-day windows
Tobacco / vapes US-21 (state by state) / EU-18, store-licence flag required
Energy drinks EU-16 in some regions, no restriction elsewhere
Sharp tools ≥ 18 in most regions
Prescription Pharmacy hand-off only (DEA Schedule II–V)
Tune the policy in the no-code Workflow Builder — no redeploy of your store-OS.
WEBHOOK EVENT NAMES
- Sessions: status changes flow through the standard session webhook.
- Verify X-Signature-V2 on every payload.
CONSTRAINTS
- Session statuses use Title Case With Spaces (Approved, In Review). Don't transform them.
- Don't store the raw document image in your store-OS — Didit holds it, the store-OS holds the shopper PID + age band only.
- Compute the age band server-side, not in the kiosk — kiosks can be tampered with.
- Log every entry attempt (Approved + Declined) signed with X-Signature-V2 for the loss-prevention dashboard. Default retention 5 years.
Read the docs:
- https://docs.didit.me/sessions-api/create-session
- https://docs.didit.me/sessions-api/retrieve-session
- https://docs.didit.me/integration/webhooks
- https://docs.didit.me/console/workflows
Start free at https://business.didit.me — sandbox key in 60 seconds, 500 verifications free every month, no credit card.$0 / month. No credit card required.
Pay only for what you use. 25+ modules. Public per-module pricing, no monthly minimum fee.
Custom MSA & SLA. For large volumes and regulated programs.
Start free → pay only when a check runs → unlock Enterprise for a custom contract, SLA, or data residency.
Didit is infrastructure for identity and fraud, the platform we wished existed when we were building products ourselves: open, flexible, and developer-friendly, so it works as a real part of your stack instead of a black box you integrate around.
One API covers verifying people (KYC, know your customer), verifying businesses (KYB, know your business), screening crypto wallets (KYT, know your transaction), and monitoring transactions in real time, on a stack built to be:
The footprint underneath: 14,000+ document types in 48+ languages, 1,000+ data sources, and 200+ fraud signals on every session. The Didit infrastructure dynamically learns from every session and gets better every day.
It's the identity + age check that lets an unstaffed store open its door to a real, eligible shopper, and refuse everyone else, without a human clerk in the loop.
The pattern shows up wherever retail goes staffless:
The shopper scans a QR or holds their face to the door camera. Didit verifies who they are and how old they are. The door opens. The basket starts. The POS blocks anything they're not allowed to buy.
Because neither proves a real human with a real age.
Underage purchase of alcohol, tobacco, and vapes is regulated in every developed market, the US (state by state, with strict liability), the EU (Tobacco Products Directive + national alcohol laws), the UK (Licensing Act 2003), Canada, Australia, Japan, Singapore. Penalties run from per-store fines to licence revocation. A real ID + face check is the only durable defence.
The full flow normally takes under 30 seconds end-to-end, pick up the ID, snap the document, snap the selfie, done. That is the fastest in the market. Legacy KYC providers usually take more than 90 seconds for the same flow.
On the back end, Didit returns the result in under two seconds at p99, measured from the moment the user finishes the selfie to the moment your webhook fires. Mobile capture is tuned for slow phones and slow networks: progressive image compression, lazy software development kit load, and a one-tap hand-off from desktop to phone via QR code if the user starts on web.
By keeping the rules server-side, not in the kiosk. The verified date of birth comes back from /v3/session/; the rule table lives in your Workflow Builder.
Typical thresholds in scope:
Edit the rules per store, per SKU, per time-of-day in the no-code Workflow Builder. No redeploy of the store-OS. The POS reads the latest policy at scan time.
Every session lands on one of seven clear statuses, so your code always knows what to do:
Approved, every check passed. Move the user forward.Declined, one or more checks failed. You can allow the user to resubmit the specific failed step (for example, re-take the selfie) without re-running the whole flow.In Review, flagged for compliance review. Open the case in the console, see every signal, decide approve or decline.In Progress, user is mid-flow.Not Started, link sent, user has not opened it yet. Send a reminder if it sits too long.Abandoned, user opened the link but did not finish in time. Re-engage or expire.Expired, the session link aged out. Create a new session.A signed webhook fires on every status change, so your database always stays in sync. Abandoned and declined sessions are free.
Production data is processed and stored in the European Union by default, on Amazon Web Services. Enterprise contracts can request alternative regions for jurisdictions whose regulators require it.
Encryption everywhere. AES-256 at rest across every database, object store, and backup. Transport Layer Security 1.3 in transit on every API call, webhook, and Business Console session. Biometric data is encrypted under a separate Customer Master Key.
Retention is yours to control. Default retention is indefinite (unlimited) unless you configure shorter, between 30 days and 10 years per application, and you can delete any individual session at any time from the dashboard or the API.
Certifications: SOC 2 Type 1 (Type 2 audit in progress), ISO/IEC 27001:2022, iBeta Level 1 PAD, and a public attestation from Spain''s Tesoro / SEPBLAC / CNMV that Didit''s remote identity verification is safer than verifying someone in person. Full report at /security-compliance.
Didit ships compliant by default for the regulators that matter to identity infrastructure:
Detailed memo, every certificate, every regulator letter: /security-compliance.
Three integration paths, pick whichever fits your stack:
Same dashboard, same billing, same pay-per-success price for all three. Step-by-step guide at docs.didit.me/integration/integration-prompt.
Every entry attempt, Approved, Declined, In Review, produces a signed log line:
session_id, Didit's verifiable identifier for the attemptshopper_pid, your pseudonymous shopper idstore_id, which store / pod / fridgetimestamp, entry time in UTCage_decision, verdict + threshold matched (e.g. Approved · 21+)signature, X-Signature-V2 HMAC SHA-256 of the payloadPipe to your loss-prevention dashboard, your state-regulator portal (for tobacco / alcohol audits), and your SIEM (Security Information and Event Management). Default retention is 5 years post-relationship, extendable per local audit rules. Ready for ABC (Alcoholic Beverage Control) board inspections in the US and equivalent national bodies in the EU.
Two things at the door, one at the till:
No Didit-branded hardware. No proprietary kiosk. The recipe runs on the cameras and terminals you already have.
Four wires:
POST /v3/session/X-Signature-V2, HMAC SHA-256). On status: Approved, send the unlock command to your door-controllerGET /v3/session/'{'sessionId'}'/decision/ when the shopper scans a restricted SKU, confirms age + regionThe Didit MCP (Model Context Protocol) server is included free, paste the integration prompt above into Claude Code, Cursor, Codex, Replit Agent, Devin, or Aider and the agent scaffolds the whole thing against the live /v3/ API.
One API for KYC, KYB, Transaction Monitoring, and Wallet Screening. Integrate in 5 minutes.