Keep bots out with a Passive Liveness gate. One frame. One decision.

You are integrating Didit Passive Liveness as a bot-gate on a high-value action — sign-up, leaderboard submission, airdrop / token claim, referral payout, comment, or ticket queue. Bots cannot pass Passive Liveness because they have no face to present to the camera. One API call. One signed webhook. One decision.

WHY THIS SHAPE
  - Bots scale because they cost nothing per attempt. CAPTCHA stops the dumbest ones but commercial solver farms beat hCaptcha and reCAPTCHA Enterprise at fractions of a cent per solve.
  - Passive Liveness asks for something a script does not have: a live human face in front of a real camera. The model decides on one frame, in under two seconds, with no user interaction beyond "hold still".
  - $0.10 per check (Passive Liveness module). 500 verifications free every month. Combine with $0.03 IP / device pre-screen to keep the camera off the obvious bots and the budget on real candidates.

PRE-REQUISITES
  - Production API key from https://business.didit.me (sandbox key in 60 seconds, no credit card).
  - A webhook endpoint with HMAC SHA-256 verification of the X-Signature-V2 header using your webhook secret.
  - A Workflow Builder workflow containing the Passive Liveness module — optionally Device & IP Analysis pre-step.
  - The high-value action wrapped in a server-side gate that defaults to BLOCK and only unblocks on a verified webhook with status: Approved.

STEP 1 — (Optional) Cheap IP / device pre-screen
  Before opening a camera, score the network with Device & IP Analysis ($0.03 / call, under 100ms).
  If the score is low and no datacenter / VPN / scripted-user-agent flags fire, run Step 2.
  If the score is high or any of those flags fire, skip the liveness call and decline up-front — this saves the camera budget for plausible humans.

STEP 2 — Open a Passive Liveness session
  POST https://verification.didit.me/v3/session/
  Headers:
    x-api-key: <your api key>
    Content-Type: application/json
  Body:
    {
      "workflow_id": "<wf id with the Passive Liveness module>",
      "vendor_data": "<your action / user id, max 256 chars>",
      "callback": "https://<your-app>/bot-gate/callback",
      "metadata": {
        "surface": "signup_form",
        "action_id": "<your internal reference>"
      }
    }

  Response: 201 Created with a hosted session URL. Redirect inline (web) or open in a Software Development Kit (SDK) webview (mobile). The action stays BLOCKED on your side until the signed webhook lands.

STEP 3 — Read the signed webhook
  Didit POSTs the verdict. Verify X-Signature-V2 (HMAC SHA-256 of the raw body using your webhook secret) BEFORE reading the JSON.

  Payload (excerpted):
    {
      "session_id": "<uuid>",
      "vendor_data": "<your action / user id>",
      "status": "Approved",
      "liveness": { "status": "Approved" }
    }

  Session status enum (exact case, Title Case With Spaces): Approved | Declined | In Review | Resubmitted | Expired | Not Finished | Kyc Expired | Abandoned.

STEP 4 — Branch the action
  Approved      → allow the sign-up / claim / submission.
  Declined      → block the action. Log liveness warnings (image-only / virtual-cam / replay / deepfake) and throttle the source IP.
  Not Finished  → invite the user to retry with a fresh session URL.
  Expired       → session timed out. Resend the link.
  Abandoned     → the user closed the flow before completing. Resend the link.

STEP 5 — (Optional) Replay Reusable Know Your Customer (KYC) for known humans
  If a user has previously completed a Didit-verified session, a fresh liveness check is not required for re-entry — they can replay their verified credential at no cost via Didit Reusable KYC. Use the user's existing session_id to confirm enrollment and skip Step 2. Free forever.

WEBHOOK EVENT NAMES
  - Sessions: standard session webhook. One endpoint, status field tells you where in the lifecycle.
  - Verify X-Signature-V2 (HMAC SHA-256) on every payload.

WHAT GETS BLOCKED
  - Headless Chrome with scripted form submission
  - Browser-automation farms (Puppeteer, Playwright, Selenium)
  - Image-only submissions (no camera attached)
  - Virtual-camera AI face injectors
  - Pre-recorded screen replays
  - Print or paper attacks
  - Silicone / latex masks
  - AI-generated deepfake faces

  All independently tested at iBeta and certified at Level 1 Presentation Attack Detection (PAD) against the full ISO/IEC 30107-3 catalogue. Re-tested every year.

CONSTRAINTS
  - Session statuses use Title Case With Spaces. Never use UPPER_SNAKE_CASE for session verdicts — that's the Transactions API.
  - Default to BLOCK on the server. Only unblock when the verified webhook says Approved.
  - 200+ fraud signals are evaluated on every session at no extra cost — read them off the decision payload, don't re-query.

Read the docs:
  - https://docs.didit.me/sessions-api/create-session
  - https://docs.didit.me/core-technology/liveness/overview
  - https://docs.didit.me/core-technology/ip-analysis/overview
  - https://docs.didit.me/core-technology/reusable-kyc/overview
  - https://docs.didit.me/integration/webhooks

Start free at https://business.didit.me — sandbox key in 60 seconds, 500 verifications free every month, no credit card.