Uthibitishaji upya wa kibayometriki bila nenosiri kwa watumiaji wanaorudi. Hakuna bili ya SMS, hakuna hatari ya SIM-swap, hakuna safari ya mtoa huduma. Injini sawa ya iBeta Level 1 PAD (utambuzi wa mashambulizi ya uwasilishaji) kama usajili. $0.10 kwa kila uthibitishaji, 500 bila malipo/mwezi.
Robinhood Ventures
Inaaminika na mashirika 2,000+ duniani kote.
Kuingia salama dhidi ya hadaa
Tumia tena utambulisho uliothibitishwa kutoka usajili ili kuthibitisha watumiaji wanaorudi. Haiathiriwi na SIM-swap, haiathiriwi na phishing, $0.10 kwa kila simu, nafuu kuliko SMS ya kawaida ya kwenda na kurudi katika kila soko.
Chagua ukaguzi unaotaka, kitambulisho, uhai (liveness), kulinganisha uso, vikwazo, anwani, umri, simu, barua pepe, maswali maalum. Ziburute kwenye mtiririko wa kazi (flow) kwenye dashibodi, au tuma mtiririko huo huo kwenye API yetu. Gawanya kulingana na masharti, fanya majaribio ya A/B, hakuna code inayohitajika.
Pachika moja kwa moja na SDK yetu ya Web, iOS, Android, React Native, au Flutter. Elekeza kwenye ukurasa uliopangishwa. Au tuma tu mtumiaji wako kiungo, kwa barua pepe, SMS, WhatsApp, popote. Chagua kinachofaa stack yako.
Didit inasimamia kamera, ishara za mwanga, uhamishaji wa simu, na ufikiaji. Wakati mtumiaji yuko kwenye mchakato, tunapima ishara 200+ za udanganyifu kwa wakati halisi na kuthibitisha kila sehemu dhidi ya vyanzo vya data vya kuaminika. Matokeo yanapatikana chini ya sekunde mbili.
Webhooks zilizosainiwa kwa wakati halisi huweka database yako sawa mara tu mtumiaji anapoidhinishwa, kukataliwa, au kutumwa kwa ukaguzi. Uliza API inapohitajika. Au fungua console kukagua kila session, kila ishara, na kudhibiti kesi kwa njia yako.
$ curl -X POST https://verification.didit.me/v3/session/ \
-H "x-api-key: $DIDIT_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"workflow_id": "wf_bio_auth",
"vendor_data": "user-42",
// base64-encoded reference selfie, ≤ 1MB
// omit this field for liveness-only mode
"portrait_image": "/9j/4AAQSkZJRgABAQE..."
}'{ "session_url": "verify.didit.me/..." }// Your endpoint receives a signed payload
app.post("/webhooks/didit", (req, res) => {
const sig = req.headers["x-signature-v2"];
const expected = crypto.createHmac("sha256", SECRET)
.update(req.rawBody).digest("hex");
if (sig !== expected) return res.sendStatus(401);
const { status, decision, vendor_data } = req.body;
// status: Approved | Declined | In Review | ...
res.sendStatus(200);
});webhook_type: "status.updated", status: "Approved"# Didit Biometric Authentication — integrate in 5 minutes
You are integrating Didit's Biometric Authentication module into <my_stack>.
This is a returning-user passwordless re-verification flow — a drop-in
replacement for SMS or email 2FA at high-value actions (large transfers,
password reset, large withdrawals, sensitive setting changes). It is NOT
the first-time KYC sign-up flow — for that, see Didit Liveness at
docs.didit.me/core-technology/liveness/overview.
Every URL, header, and enum value below is canonical — do not paraphrase
or "improve" them.
## 1. Provision an account
- Sign up: https://business.didit.me (no credit card required).
- Or provision programmatically: POST https://apx.didit.me/auth/v2/programmatic/register/
(returns an API key bound to the workspace + application).
## 2. Create the biometric_authentication workflow (one time)
Biometric Authentication is a workflow_type, not a feature flag. Create
the workflow once, reuse the workflow_id for every authentication.
POST https://verification.didit.me/v3/workflows/
Header: x-api-key: <your-api-key>
Body:
- workflow_label (your label, e.g. "step-up-2fa")
- workflow_type "biometric_authentication" (snake_case enum)
- features the array
[{ feature: "LIVENESS" }] (liveness-only mode)
OR
[{ feature: "LIVENESS" }, { feature: "FACE_MATCH" }] (face-match mode)
- liveness_method "PASSIVE" | "FLASHING" | "ACTIVE_3D" (PASSIVE recommended for low-friction step-up)
Store the returned workflow_id — you will reuse it on every auth.
## 3. Authenticate a returning user
POST https://verification.didit.me/v3/session/
Header: x-api-key: <your-api-key>
Header: Content-Type: application/json
Body:
- workflow_id (from step 2)
- vendor_data (your own user id, e.g. "user-42")
- callback (optional URL we redirect the user to after capture)
- metadata (optional JSON, surfaced back on the webhook)
- portrait_image (Base64 JPEG, REQUIRED when the workflow has FACE_MATCH;
OMIT for liveness-only mode)
The portrait_image is the stored reference photo from the user's original
KYC verification (you already have it as id_verification.portrait_image in
the original session response). Send it as a Base64-encoded JPEG, max 1 MB.
Response: session_url — redirect the user to it. Didit hosts the capture
(camera, motion prompts, low-light fallback, accessibility) and posts the
verdict back via webhook.
## 4. Webhooks
- Register a webhook destination once via
POST https://verification.didit.me/v3/webhook/destinations/
Body: url, subscribed_events: ["session.verified", "session.declined",
"session.review_started"]
- Response includes secret_shared_key — store it.
- Every webhook delivery carries an X-Signature-V2 header you MUST verify
before trusting the payload. HMAC-SHA256 verification MUST run against the raw body bytes (the raw payload as Didit sent it) BEFORE any JSON parsing — re-serialising the parsed body changes whitespace and key order, which invalidates the signature.Algorithm:
1. sortKeys(payload) recursively
2. shortenFloats (truncate trailing zeros after the decimal point)
3. JSON.stringify the result
4. HMAC-SHA256 with the secret_shared_key
5. Hex-encode, compare to the X-Signature-V2 header.
## 5. Reading the report
The webhook payload (and the GET /v3/session/{id}/decision/ response)
returns the combined biometric_authentication shape:
status "Approved" | "Declined" | "Not Finished"
workflow_id string
session_id uuid
session_number integer
vendor_data your user id
liveness:
status "Approved" | "Declined" | "Not Finished"
method "PASSIVE" | "FLASHING" | "ACTIVE_3D"
score number 0-100
reference_image signed URL to the captured selfie (expires in 1 hour)
video_url signed URL (FLASHING and ACTIVE_3D only, expires in 1 hour)
warnings array
face_match: (only present in face-match mode)
status "Approved" | "Declined" | "Not Finished"
score number 0-100 (similarity %)
source_image signed URL to the captured selfie
target_image signed URL to the supplied portrait_image
warnings array
Overall status is "Approved" only when liveness.status == "Approved" AND
(face_match is absent OR face_match.status == "Approved").
Auto-decline triggers (always enforced by Didit, not configurable):
FACE_IN_BLOCKLIST, NO_FACE_DETECTED, LIVENESS_FACE_ATTACK, NO_REFERENCE_IMAGE
Configurable risks (action per workflow — Decline, Review, or Approve):
LOW_LIVENESS_SCORE, LOW_FACE_MATCH_SIMILARITY
## 6. Hard rules — do not change
- Base URL for /v3/* endpoints is verification.didit.me (NOT apx.didit.me).
- workflow_type is snake_case: biometric_authentication.
- Feature enums inside the workflow are UPPERCASE: LIVENESS, FACE_MATCH.
- Liveness method enum is UPPERCASE: PASSIVE, FLASHING, ACTIVE_3D.
- Auth header is x-api-key (lowercase, hyphenated).
- Webhook signature header is X-Signature-V2 (NOT X-Signature).
- Always verify webhook signatures before trusting payload data.
- Status casing matches exactly: "Approved", "Declined", "In Review",
"Not Finished" (title-cased, space-separated).
- portrait_image is Base64 JPEG, max 1 MB, required only in face-match mode.
## 7. Pricing reference (public)
- Biometric Authentication: $0.10 per authentication (passwordless re-auth).
- 500 free authentications every month, forever, on every account.
- For the original sign-up KYC, see https://didit.me/pricing (full KYC
bundle is $0.33 per onboarded user, which includes Liveness + Face Match +
ID Verification + Device & IP Analysis).
## 8. When to use this versus Liveness directly
- First-time KYC sign-up: use Liveness (the feature) inside an ID
Verification workflow. See docs.didit.me/core-technology/liveness/overview.
- Step-up at sensitive actions (transfer, password reset, large
withdrawal): use this Biometric Authentication workflow.
- High-volume passive monitoring (any login): use this workflow with
liveness-only mode (no portrait_image) — fastest, lowest friction.
## 9. Verify your integration
- Sandbox starts on signup at https://business.didit.me — no separate flag.
- Test images: deterministic synthetic faces returned in sandbox
(Approved by default; trigger Declined by sending the canonical "spoof"
test image).
- Switch to live: flip the application's environment toggle in console.
When in doubt: https://docs.didit.me/core-technology/biometric-auth/overview
$0 / mwezi. Hakuna kadi ya mkopo inayohitajika.
Lipa tu kwa unachotumia. Moduli 25+. Bei za umma kwa kila moduli, hakuna ada ya chini ya kila mwezi.
MSA & SLA maalum. Kwa idadi kubwa na programu zilizodhibitiwa.
Anza bure → lipa tu wakati ukaguzi unafanyika → fungua Enterprise kwa mkataba maalum, SLA, au uhifadhi wa data.
Didit ni miundombinu ya utambulisho na ulaghai, jukwaa ambalo tulitamani lingekuwepo tulipokuwa tukijenga bidhaa sisi wenyewe: wazi, rahisi, na rafiki kwa watengenezaji, ili lifanye kazi kama sehemu halisi ya stack yako badala ya sanduku jeusi unalounganisha.
API moja inashughulikia kuthibitisha watu (KYC, know your customer), kuthibitisha biashara (KYB, know your business), kuchunguza pochi za crypto (KYT, know your transaction), na kufuatilia miamala kwa wakati halisi, kwenye stack iliyojengwa kuwa:
Msingi wake: aina 14,000+ za hati katika lugha 48+, vyanzo vya data 1,000+, na ishara za ulaghai 200+ kwenye kila kipindi. Miundombinu ya Didit inajifunza kwa nguvu kutoka kila kipindi na inaboresha kila siku.
workflow_type (snake-case: biometric_authentication) inayounda kipengele cha LIVENESS na kipengele cha hiari cha FACE_MATCH. Liveness peke yake ni uwezo wa kujisajili, angalia /products/liveness kwa mtiririko wa kwanza wa know-your-customer (KYC). Zote mbili zinatumia injini sawa iliyothibitishwa na iBeta Level 1 Presentation Attack Detection (PAD), hivyo mfumo ambao mtumiaji wako alipitia wakati wa usajili ndio mfumo huo huo unaomchunguza kila anapoingia.status (Approved, Declined, Not Finished), kizuizi cha liveness chenye status, method (PASSIVE, FLASHING, au ACTIVE_3D), score 0-100, reference_image, video_url, na warnings, pamoja na kizuizi cha face_match (kinachopatikana tu wakati mtiririko una FACE_MATCH) chenye status, score 0-100, source_image, target_image, na warnings. URL za picha na video zilizosainiwa huisha baada ya dakika 60. status ya jumla ni Approved tu wakati liveness imeidhinishwa NA (face match haipo AU face match imeidhinishwa).Mchakato mzima kwa kawaida huchukua chini ya sekunde 30 kuanzia mwanzo hadi mwisho, chukua kitambulisho, piga picha ya hati, piga selfie, umemaliza. Huu ndio mchakato wa haraka zaidi sokoni. Watoa huduma wa zamani wa KYC kwa kawaida huchukua zaidi ya sekunde 90 kwa mchakato huo huo.
Kwa upande wa backend, Didit inarudisha matokeo kwa chini ya sekunde mbili kwa p99, ikipimwa kuanzia wakati mtumiaji anamaliza selfie hadi wakati webhook yako inapoanza. Upigaji picha wa simu umeboreshwa kwa simu za polepole na mitandao ya polepole: ukandamizaji wa picha unaoendelea, upakiaji wa polepole wa software development kit, na uhamishaji wa haraka kutoka kompyuta hadi simu kupitia msimbo wa QR ikiwa mtumiaji anaanza kwenye wavuti.
FACE_IN_BLOCKLIST, NO_FACE_DETECTED, LIVENESS_FACE_ATTACK, na NO_REFERENCE_IMAGE. Maonyo yanayoweza kusanidiwa, LOW_LIVENESS_SCORE na LOW_FACE_MATCH_SIMILARITY, hukuruhusu kurekebisha vizingiti vya ukaguzi na kukataa kwa kila programu.Kila kipindi huishia katika mojawapo ya hadhi saba zilizo wazi, hivyo code yako inajua nini cha kufanya kila wakati:
Approved, kila ukaguzi umefaulu. Mpeleke mtumiaji mbele.Declined, ukaguzi mmoja au zaidi umefeli. Unaweza kumruhusu mtumiaji kutuma upya hatua maalum iliyofeli (kwa mfano, kupiga selfie upya) bila kurudia mchakato mzima.In Review, imewekewa alama kwa ukaguzi wa kufuata sheria. Fungua kesi kwenye console, angalia kila ishara, amua kuidhinisha au kukataa.In Progress, mtumiaji yuko katikati ya mchakato.Not Started, kiungo kimetumwa, mtumiaji bado hajafungua. Tuma ukumbusho ikiwa itakaa muda mrefu sana.Abandoned, mtumiaji alifungua kiungo lakini hakumaliza kwa wakati. Mshawishi tena au muda wake uishe.Expired, muda wa kiungo cha kipindi umeisha. Unda kipindi kipya.Webhook iliyosainiwa huwashwa kila mabadiliko ya hadhi, hivyo database yako inabaki kusawazishwa kila wakati. Vipindi vilivyoachwa na vilivyokataliwa ni bure.
Data ya uzalishaji huchakatwa na kuhifadhiwa katika Umoja wa Ulaya kwa chaguo-msingi, kwenye Amazon Web Services. Mikataba ya biashara inaweza kuomba maeneo mbadala kwa mamlaka ambazo wasimamizi wake wanahitaji.
Usimbaji fiche kila mahali. AES-256 ikiwa imetulia kwenye kila database, hifadhi ya vitu, na chelezo. Transport Layer Security 1.3 ikiwa safarini kwenye kila API call, webhook, na kipindi cha Business Console. Data ya biometriska imesimbwa kwa kutumia Customer Master Key tofauti.
Uhifadhi ni wako kudhibiti. Uhifadhi chaguomsingi ni usio na kikomo (unlimited) isipokuwa ukisanidi muda mfupi zaidi, kati ya siku 30 na miaka 10 kwa kila programu, na unaweza kufuta kipindi chochote cha kibinafsi wakati wowote kutoka kwenye dashibodi au API.
Vyeti: SOC 2 Type 1 (ukaguzi wa Type 2 unaendelea), ISO/IEC 27001:2022, iBeta Level 1 PAD, na uthibitisho wa umma kutoka Tesoro / SEPBLAC / CNMV ya Hispania kwamba uthibitishaji wa utambulisho wa mbali wa Didit ni salama zaidi kuliko kumthibitisha mtu ana kwa ana. Ripoti kamili inapatikana kwenye /security-compliance.
Didit inatii sheria kwa chaguo-msingi kwa wasimamizi muhimu kwa miundombinu ya utambulisho:
Memo ya kina, kila cheti, kila barua ya mdhibiti: /security-compliance.
Njia tatu za kuunganisha, chagua inayofaa stack yako:
Dashibodi sawa, bili sawa, bei sawa ya kulipa kwa mafanikio kwa zote tatu. Mwongozo wa hatua kwa hatua unapatikana kwenye docs.didit.me/integration/integration-prompt.
API moja kwa KYC, KYB, Ufuatiliaji wa Miamala, na Uchunguzi wa Wallet. Unganisha ndani ya dakika 5.