Enrol the buyer once at purchase. Every gate scan is a sub-1-second 1:N face match. Free per scan after enrolment. 500 verifications free every month.
Robinhood Ventures
Trusted by 2,000+ organizations worldwide.
Stadiums · Festivals · Transit · Conferences
No phone-out, no battery anxiety, no resale fraud. The buyer enrols once at purchase for $0.25, and every future gate scan is a free 1:N Face Search match , sub-1-second at festival scale. Same flow works across stadiums, festivals, transit corridors, and conferences.
Pick the checks you want, ID, liveness, face match, sanctions, address, age, phone, email, custom questions. Drag them into a flow in the dashboard, or post the same flow to our API. Branch on conditions, run A/B tests, no code required.
Embed natively with our Web, iOS, Android, React Native, or Flutter SDK. Redirect to a hosted page. Or just send your user a link, by email, SMS, WhatsApp, anywhere. Pick what fits your stack.
Didit hosts the camera, the lighting cues, the mobile hand-off, and accessibility. While the user is in the flow, we score 200+ fraud signals in real time and verify every field against authoritative data sources. Result in under two seconds.
Real-time signed webhooks keep your database in sync the moment a user is approved, declined, or sent to review. Poll the API on demand. Or open the console to inspect every session, every signal, and manage cases your way.
Didit · Enrolment
Order #18472
Capture your face
Didit · Face Search 1:N
Didit · Gate decision
Didit · Venue coverage
Didit · Capacity
Didit · Public pricing
$ curl -X POST https://verification.didit.me/v3/session/ \
-H "x-api-key: $DIDIT_API_KEY" \
-d '{
"workflow_id": "wf_event_enrol",
"vendor_data": "buyer-42",
"metadata": { "event_id": "evt_1234" }
}'ID_VERIFICATION + LIVENESS; binds the portrait to vendor_data.docs →$ curl -X POST https://verification.didit.me/v3/face-search/ \
-H "x-api-key: $DIDIT_API_KEY" \
-F "image=@gate-frame.jpg" \
-F "metadata={'event_id':'evt_1234'}"You are integrating Didit's biometric event-ticketing into <my_stack>. The face IS the ticket — no QR code, no barcode, no printout. Two phases:
1. Enrol the buyer ONCE at ticket purchase. A Sessions API call runs ID Verification + Passive Liveness and stores the buyer's portrait as the event-index template.
2. At every gate scan, call the standalone Face Search 1:N endpoint with the camera frame. Sub-1-second match against the event index. Verdict returned inline.
Pricing (public):
- Enrolment (one-time per buyer): $0.15 ID Verification + $0.10 Passive Liveness = $0.25
- Face Search 1:N at the gate: free per scan
- First 500 verifications free every month, forever
PRE-REQUISITES
- Production API key from https://business.didit.me (sandbox key in 60s, no card).
- Webhook endpoint with Hash-based Message Authentication Code (HMAC) SHA-256 verification using the X-Signature-V2 header.
HMAC-SHA256 verification MUST run against the raw body bytes (the raw payload as Didit sent it) BEFORE any JSON parsing — re-serialising the parsed body changes whitespace and key order, which invalidates the signature. - A workflow_id from the Workflow Builder. The workflow MUST contain ID_VERIFICATION + LIVENESS (and optionally Anti-Money Laundering (AML) if you sell age-restricted access).
- One Didit account = one face index. Tag every enrolment with metadata.event_id so the gate-side search filters by the right event.
STEP 1 — Enrol at ticket purchase
POST https://verification.didit.me/v3/session/
Headers:
x-api-key: <your api key>
Content-Type: application/json
Body:
{
"workflow_id": "<your enrolment workflow>",
"vendor_data": "<your buyer id — must be unique per buyer>",
"callback": "https://<your-app>/ticketing/enrol/callback",
"metadata": {
"order_id": "<your order reference>",
"event_id": "<the event the buyer is entering>",
"ticket_tier": "<GA | VIP | accessible | etc>"
}
}
Response: 201 Created with the hosted session_url. Redirect the buyer. After the buyer completes ID Verification + Passive Liveness, the portrait is stored as their face template and bound to vendor_data.
STEP 2 — Read the signed verdict on enrolment completion
Body (excerpted):
{
"session_id": "<uuid>",
"vendor_data": "<your buyer id>",
"status": "Approved",
"id_verification": { "status": "Approved", "document_type": "Passport" },
"liveness": { "status": "Approved", "method": "PASSIVE", "score": 94 }
}
Verify X-Signature-V2 BEFORE trusting the body. On Approved, mark the order as enrolled and bind the order to vendor_data in your application database.
Session status enum (exact case): Approved | Declined | In Review | Resubmitted | Expired | Not Finished | Kyc Expired | Abandoned.
STEP 3 — At every gate scan, match the face against the event index
POST https://verification.didit.me/v3/face-search/
Headers:
x-api-key: <your api key>
Body (multipart/form-data):
image <the camera frame captured at the gate>
vendor_data <optional — restrict the search to a specific buyer>
metadata <optional JSON — e.g. { "event_id": "<...>" } to filter>
Response (excerpted):
{
"status": "Approved",
"matches": [
{
"vendor_data": "<buyer id>",
"similarity_score": 0.96
}
]
}
Match outcomes the gate logic should handle:
- Match found, ticket valid, no prior scan → grant entry, mark scanned
- Match found, already inside → apply re-entry policy
- Match found, ticket expired or canceled → route to staff
- Match found, ticket resold to another buyer → block, route to staff
- No match (similarity below threshold) → block, fall back to backup ticket flow
STEP 4 — Reusable across every event the same buyer attends
Because the buyer's face template is bound to vendor_data, the SAME enrolment works for every future event the same buyer holds a ticket for. No re-enrolment, no re-payment. Reusable Credential semantics applied to the venue use case.
CONSTRAINTS
- Base URL for /v3/* endpoints is verification.didit.me (NOT apx.didit.me).
- Feature enum is UPPERCASE: ID_VERIFICATION, LIVENESS, FACE_MATCH, AML, IP_ANALYSIS.
- Method enum is UPPERCASE: PASSIVE, FLASHING, ACTIVE_3D.
- Auth header is x-api-key (lowercase, hyphenated).
- Webhook signature header is X-Signature-V2 (NOT X-Signature).
- Status casing matches exactly: Approved, Declined, In Review, Expired, Not Finished, Resubmitted, Kyc Expired, Abandoned.
- The face template is irreversible (a one-way hash). End users can request deletion via the standard data-subject-request path.
ACCESS CONTROL CONSIDERATIONS
- For minor-attended events, run AGE_ESTIMATION during enrolment to gate age-restricted areas. See /solutions/age-verification.
- For high-value VIP areas, gate behind a Biometric Authentication step-up. See /solutions/biometric-2fa.
- For accessibility lanes, surface the ticket-tier metadata on the verdict payload and route the gate UI accordingly.
DATA-PROTECTION NOTES
- The enrolment selfie produces an irreversible face template; raw images are deleted unless retention is explicitly enabled.
- The gate frame is processed in memory and not persisted by default.
- Display the privacy notice (didit.me/terms/verification-privacy-notice) to the buyer before the enrolment selfie. EU GDPR Article 13 requires it.
Read the docs:
- https://docs.didit.me/core-technology/face-search/overview
- https://docs.didit.me/sessions-api/create-session
- https://docs.didit.me/integration/webhooks
Start free at https://business.didit.me — sandbox key in 60 seconds, 500 verifications free every month, no credit card.$0 / month. No credit card required.
Pay only for what you use. 25+ modules. Public per-module pricing, no monthly minimum fee.
Custom MSA & SLA. For large volumes and regulated programs.
Start free → pay only when a check runs → unlock Enterprise for a custom contract, SLA, or data residency.
Didit is infrastructure for identity and fraud, the platform we wished existed when we were building products ourselves: open, flexible, and developer-friendly, so it works as a real part of your stack instead of a black box you integrate around.
One API covers verifying people (KYC, know your customer), verifying businesses (KYB, know your business), screening crypto wallets (KYT, know your transaction), and monitoring transactions in real time, on a stack built to be:
The footprint underneath: 14,000+ document types in 48+ languages, 1,000+ data sources, and 200+ fraud signals on every session. The Didit infrastructure dynamically learns from every session and gets better every day.
A ticket where the access token is the buyer's face, not a Quick Response (QR) code, a barcode, or a paper printout.
The buyer takes a selfie at purchase. The face template is stored against the order. At the gate, a camera captures one frame and 1:N face search matches it against the event's enrolled templates. Sub-1-second verdict, walk through.
Three problems with QR-based ticketing:
The full flow normally takes under 30 seconds end-to-end, pick up the ID, snap the document, snap the selfie, done. That is the fastest in the market. Legacy KYC providers usually take more than 90 seconds for the same flow.
On the back end, Didit returns the result in under two seconds at p99, measured from the moment the user finishes the selfie to the moment your webhook fires. Mobile capture is tuned for slow phones and slow networks: progressive image compression, lazy software development kit load, and a one-tap hand-off from desktop to phone via QR code if the user starts on web.
Always ship a non-biometric fallback, a printed PDF, an email-delivered QR code, or a staffed gate. The European Union Artificial Intelligence Act and most national consumer-protection regimes require an alternative path.
In practice, venues running biometric ticketing report 70-85% opt-in because the face lane is dramatically faster. The non-biometric lane stays open for the rest.
Every session lands on one of seven clear statuses, so your code always knows what to do:
Approved, every check passed. Move the user forward.Declined, one or more checks failed. You can allow the user to resubmit the specific failed step (for example, re-take the selfie) without re-running the whole flow.In Review, flagged for compliance review. Open the case in the console, see every signal, decide approve or decline.In Progress, user is mid-flow.Not Started, link sent, user has not opened it yet. Send a reminder if it sits too long.Abandoned, user opened the link but did not finish in time. Re-engage or expire.Expired, the session link aged out. Create a new session.A signed webhook fires on every status change, so your database always stays in sync. Abandoned and declined sessions are free.
Production data is processed and stored in the European Union by default, on Amazon Web Services. Enterprise contracts can request alternative regions for jurisdictions whose regulators require it.
Encryption everywhere. AES-256 at rest across every database, object store, and backup. Transport Layer Security 1.3 in transit on every API call, webhook, and Business Console session. Biometric data is encrypted under a separate Customer Master Key.
Retention is yours to control. Default retention is indefinite (unlimited) unless you configure shorter, between 30 days and 10 years per application, and you can delete any individual session at any time from the dashboard or the API.
Certifications: SOC 2 Type 1 (Type 2 audit in progress), ISO/IEC 27001:2022, iBeta Level 1 PAD, and a public attestation from Spain''s Tesoro / SEPBLAC / CNMV that Didit''s remote identity verification is safer than verifying someone in person. Full report at /security-compliance.
Didit ships compliant by default for the regulators that matter to identity infrastructure:
Detailed memo, every certificate, every regulator letter: /security-compliance.
Three integration paths, pick whichever fits your stack:
Same dashboard, same billing, same pay-per-success price for all three. Step-by-step guide at docs.didit.me/integration/integration-prompt.
Any commodity IP camera or tablet works, POST /v3/face-search/ accepts a single JPEG frame over HTTPS. Most venues use existing entry kiosks, ticket-scanner replacements, or a tablet on a stand. No custom Software Development Kit (SDK), no special drivers, no on-premise inference box.
For edge-cached gates (transit, large venues without reliable connectivity), Didit ships an on-premise face-search appliance, talk to sales.
Run AGE_ESTIMATION at enrolment for age-gated zones (over-18 areas at a festival, alcohol bars at a stadium). The signed verdict carries an age band per buyer, and your gate logic surfaces the right wristband colour or wristband-free lane.
For minors attending family events, a parent / guardian completes the enrolment on the minor's ticket and consents to the template on the minor's behalf, the EU General Data Protection Regulation requires explicit parental consent under age 16 in most member states.
One API for KYC, KYB, Transaction Monitoring, and Wallet Screening. Integrate in 5 minutes.