Alama ya kidole ya kifaa, chapa, mfumo, kivinjari, mfumo wa uendeshaji (OS), jukwaa, zinanasa pamoja na IP, eneo la kijiografia, Virtual Private Network (VPN) / proxy / Tor, bendera ya kituo cha data, na sheria za Duplicated-Device + Duplicated-IP. Hitimisho moja. $0.03 kwa kila ukaguzi, imejumuishwa kwenye KYC kamili ya $0.33 (mjue mteja wako). 500 bila malipo kila mwezi.
Inaaminika na mashirika 2,000+ duniani kote.
Ishara 200+ za udanganyifu
Kila kipindi kinarudisha chapa ya kifaa, mfumo, familia ya kivinjari, mfumo wa uendeshaji, jukwaa, na alama ya kidole ya kifaa thabiti, ikiambatana na eneo kamili la kijiografia la IP, mwendeshaji wa mtandao, bendera ya Virtual Private Network (VPN) / proxy / Tor, bendera ya kituo cha data, na sheria za Duplicated-Device + Duplicated-IP. Simu moja, ishara 200+, p99 chini ya sekunde 2.
Chagua ukaguzi unaotaka, Kitambulisho, uhai, ulinganishaji wa nyuso, vikwazo, anwani, umri, simu, barua pepe, maswali maalum. Ziburute kwenye mtiririko kwenye dashibodi, au tuma mtiririko huo huo kwenye API yetu. Gawanya kwa masharti, fanya majaribio ya A/B, hakuna msimbo unaohitajika.
Nchi · kanda · jiji · lat · long
Nchi
Nchi ya IP
Jiji
Umbali hadi Kitambulisho
VPN · proxy · Tor exit nodes
Huweka bendera kiotomatiki is_data_center kwa kila ombi
Kwa kila application · kwa kila workflow
Standalone au bundled · lipa kwa kila kipindi
Uhakiki huru wa IP
KYC kamili · IP imejumuishwa
{
"ip_analysis": {
"status": "Imeidhinishwa",
"is_vpn_or_tor": false,
"is_data_center": false,
"price": "$0.03"
}
}$ curl -X POST https://verification.didit.me/v3/session/ \
-H "x-api-key: $DIDIT_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"workflow_id": "wf_ip_only",
"vendor_data": "user-42"
}'{ "session_url": "verify.didit.me/..." }// Your endpoint receives a signed payload
app.post("/webhooks/didit", (req, res) => {
const sig = req.headers["x-signature-v2"];
const expected = crypto.createHmac("sha256", SECRET)
.update(req.rawBody).digest("hex");
if (sig !== expected) return res.sendStatus(401);
const { status, decision, vendor_data } = req.body;
// status: Approved | Declined | In Review | ...
res.sendStatus(200);
});{ webhook_type: "status.updated", status: "Approved" }# Didit Device & IP Analysis — integrate in 5 minutes
You are integrating Didit's Device & IP Analysis (VPN, datacenter, Tor, geolocation,
device intelligence) module into <my_stack>. Follow these steps exactly.
Every URL, header, and enum value below is canonical — do not paraphrase
or "improve" them.
## 1. Provision an account
- Sign up: https://business.didit.me (no credit card required).
- Or provision programmatically: POST https://apx.didit.me/auth/v2/programmatic/register/
(returns an API key bound to the workspace + application).
## 2. Integration path — Workflow Builder (session-only)
Device & IP Analysis runs inside a Didit session — there is no standalone
POST /v3/ip-analysis/ endpoint. The IP and device fingerprint are
captured automatically when the user lands on the hosted UI, so you
do not collect or send them yourself.
1. Create a workflow that includes the IP_ANALYSIS feature:
POST https://verification.didit.me/v3/workflows/
Authorization header: x-api-key: <your-api-key>
Body: workflow_label, features array including
{ feature: "IP_ANALYSIS" } (UPPERCASE — strict enum)
Combine with ID_VERIFICATION, LIVENESS, FACE_MATCH in the same
workflow for the full $0.33 Know Your Customer (KYC) bundle (Device & IP Analysis is included).
2. (Optional) Configure per-warning actions in the console for the
application — pick Decline, Review, or Approve for each of
PRIVATE_NETWORK_DETECTED, COUNTRY_FROM_DOCUMENT_DOES_NOT_MATCH_COUNTRY_FROM_IP,
EXPECTED_IP_ADDRESS_MISMATCH, DUPLICATED_IP_ADDRESS,
DUPLICATED_DEVICE_FINGERPRINT.
3. (Optional) Pin an expected IP per session: pass expected_ip_address
in the POST /v3/session/ body if you already know where the user
should be (for example: their last known login IP).
4. Create a verification session for an end user:
POST https://verification.didit.me/v3/session/
Body: workflow_id (from step 1), vendor_data (your own user id),
optional expected_ip_address.
Response: session_url — redirect the user to it.
5. Listen for webhook callbacks (see "Webhooks" below).
## 3. Webhooks
- Register a webhook destination once via
POST https://verification.didit.me/v3/webhook/destinations/
Body: url, subscribed_events: ["session.verified", "session.review_started",
"session.declined"]
- Response includes secret_shared_key — store it.
- Every webhook delivery carries an X-Signature-V2 header you MUST verify
before trusting the payload. HMAC-SHA256 verification MUST run against the raw body bytes (the raw payload as Didit sent it) BEFORE any JSON parsing — re-serialising the parsed body changes whitespace and key order, which invalidates the signature.Algorithm:
1. sortKeys(payload) recursively
2. shortenFloats (truncate trailing zeros after the decimal point)
3. JSON.stringify the result
4. HMAC-SHA256 with the secret_shared_key
5. Hex-encode, compare to the X-Signature-V2 header.
## 4. Reading the report
The session decision payload contains an ip_analysis object with:
- status: "Approved" | "Declined" | "In Review" | "Not Finished"
- ip_address, ip_country, ip_country_code, ip_state, ip_city
- latitude, longitude, time_zone, time_zone_offset
- isp, organization
- is_vpn_or_tor (boolean) — fires the PRIVATE_NETWORK_DETECTED warning
- is_data_center (boolean) — hosting/datacenter origin
- device_brand, device_model, browser_family, os_family, platform
(mobile or desktop)
- locations_info with ip, id_document, poa_document blocks — each
carries a location object plus distance_from_* fields in kilometres
- matches array — cross-session matches on ip_address or
device_fingerprint when the same value appears under a different
vendor_data
- warnings array — each entry has risk, log_type,
short_description, long_description
Auto-decline risks (always enforced by Didit, not configurable):
- IP_ADDRESS_IN_BLOCKLIST
- DEVICE_FINGERPRINT_IN_BLOCKLIST
Configurable risks (action per workflow — Decline, Review, or Approve):
- PRIVATE_NETWORK_DETECTED (VPN, proxy, Tor)
- COUNTRY_FROM_DOCUMENT_DOES_NOT_MATCH_COUNTRY_FROM_IP
- EXPECTED_IP_ADDRESS_MISMATCH
- DUPLICATED_IP_ADDRESS (default: Approve)
- DUPLICATED_DEVICE_FINGERPRINT (default: Approve)
## 5. Hard rules — do not change
- Base URL for /v3/* endpoints is verification.didit.me (NOT apx.didit.me).
- Feature enum is UPPERCASE: IP_ANALYSIS, ID_VERIFICATION, LIVENESS, FACE_MATCH, AML.
- Auth header is x-api-key (lowercase, hyphenated).
- Webhook signature header is X-Signature-V2 (NOT X-Signature).
- Always verify webhook signatures before trusting payload data.
- Status casing matches exactly: "Approved", "Declined", "In Review",
"Not Finished" (title-cased, space-separated).
- Always pass vendor_data (your own user id). Without it, every session
is treated as a unique user and DUPLICATED_IP_ADDRESS /
DUPLICATED_DEVICE_FINGERPRINT noise rises sharply.
## 6. Pricing reference (public)
- IP_ANALYSIS as a session add-on: $0.03 per check
- Bundled in a full KYC workflow (ID_VERIFICATION + LIVENESS +
FACE_MATCH + IP_ANALYSIS): $0.33 per session — Device & IP Analysis is
already included at the bundle price.
- 500 free checks every month, forever, on every account.
## 7. Verify your integration
- Sandbox starts on signup at https://business.didit.me — no separate flag.
- Test IPs: deterministic synthetic responses returned in sandbox (Approved
by default; trigger PRIVATE_NETWORK_DETECTED by using a known VPN exit IP
on the verification device).
- Switch to live: flip the application's environment toggle in console.
When in doubt: https://docs.didit.me/core-technology/ip-analysis/overview
Kwa ajili ya kuunda, kujaribu, na watumiaji wako wa kwanza.
Moduli 25+, bei wazi. Punguzo la kiotomatiki kwa wingi.
Kwa kiasi kikubwa na programu zilizodhibitiwa.
Punguzo la wingi hutumika kiotomatiki kadri matumizi yanavyoongezeka — hakuna mazungumzo, hakuna simu ya mauzo.
Didit ni miundombinu ya utambulisho na udanganyifu, jukwaa ambalo tulitamani lingekuwepo tulipokuwa tukijenga bidhaa sisi wenyewe: wazi, rahisi, na rafiki kwa waendelezaji, ili lifanye kazi kama sehemu halisi ya stack yako badala ya sanduku jeusi unalounganisha.
API moja inashughulikia kuthibitisha watu (KYC, mjue mteja wako), kuthibitisha biashara (KYB, ijue biashara yako), kuchunguza pochi za crypto (KYT, ijue miamala yako), na kufuatilia miamala kwa wakati halisi, kwenye stack iliyojengwa kuwa:
Alama ya miguu chini: aina 14,000+ za hati katika lugha 48+, vyanzo vya data 1,000+, na ishara za udanganyifu 200+ kwenye kila kipindi. Miundombinu ya Didit hujifunza kwa nguvu kutoka kila kipindi na inakuwa bora kila siku.
device_brand, device_model, browser_family, os_family (mfumo wa uendeshaji), platform (simu au kompyuta), na device_fingerprint thabiti. Fingerprint hudumu hata baada ya cookies kufutwa na vipindi vya incognito, kwa hivyo kifaa kilekile kinaporudi chini ya utambulisho mpya, kinalinganishwa kwenye array ya matches na kuonyeshwa kama onyo la Kifaa Kilichorudiwa. Marejeleo kamili yanapatikana docs.didit.me/core-technology/ip-analysis/report-ip-analysis.ip_address, ip_country, ip_country_code (Shirika la Kimataifa la Viwango 3166-1 alpha-2), ip_state, ip_city, latitude, longitude, isp (mtoa huduma wa intaneti), organization, time_zone, na time_zone_offset. IP halisi, eneo lililotatuliwa, na mwendeshaji wa mtandao vyote viko kwenye kitu kimoja, kwa hivyo unaweza kujenga ramani, kumbukumbu za ukaguzi, na dashibodi za hatari kutoka chanzo kimoja cha ukweli.Mchakato mzima kwa kawaida huchukua chini ya sekunde 30 kuanzia mwanzo hadi mwisho, chukua kitambulisho, piga picha hati, piga picha selfie, umemaliza. Huu ndio kasi zaidi sokoni. Watoa huduma wa zamani wa KYC kwa kawaida huchukua zaidi ya sekunde 90 kwa mchakato huo huo.
Kwa upande wa nyuma, Didit inarudisha matokeo kwa chini ya sekunde mbili kwa p99, ikipimwa kutoka wakati mtumiaji anamaliza selfie hadi wakati webhook yako inawaka. Upigaji picha wa simu umeboreshwa kwa simu za polepole na mitandao ya polepole: ukandamizaji wa picha unaoendelea, upakiaji wa polepole wa SDK, na uhamishaji wa kugusa mara moja kutoka kompyuta hadi simu kupitia msimbo wa QR ikiwa mtumiaji anaanza kwenye wavuti.
ip_address na device_fingerprint. Wakati kulinganisha kunapatikana kwenye kipindi kinachomilikiwa na mtumiaji tofauti wa `vendor_data`, sheria inawaka, IP Iliyorudiwa kwa kulinganisha IP, Kifaa Kilichorudiwa kwa kulinganisha fingerprint. Kila kulinganisha huangukia kwenye array ya ip_analysis.matches na session_id inayolingana, session_number, vendor_data, match_type, matched_value, pamoja na blocks za device_info na location_info. Daima pitisha vendor_data (kitambulisho chako cha mtumiaji) kwenye uundaji wa kipindi, bila hiyo, kila kipindi kinachukuliwa kama mtumiaji wa kipekee na kelele za kurudia huongezeka sana.Kila kipindi huangukia kwenye mojawapo ya hali saba zilizo wazi, kwa hivyo msimbo wako unajua nini cha kufanya:
Approved, kila ukaguzi umepita. Endelea na mtumiaji.Declined, ukaguzi mmoja au zaidi umeshindwa. Unaweza kumruhusu mtumiaji kutuma tena hatua maalum iliyoshindwa (kwa mfano, piga tena selfie) bila kurudia mchakato mzima.In Review, imewekwa alama kwa ukaguzi wa kufuata. Fungua kesi kwenye console, angalia kila ishara, amua kuidhinisha au kukataa.In Progress, mtumiaji yuko katikati ya mchakato.Not Started, kiungo kimetumwa, mtumiaji bado hajafungua. Tuma ukumbusho ikiwa inakaa muda mrefu sana.Abandoned, mtumiaji alifungua kiungo lakini hakumaliza kwa wakati. Mshirikishe tena au muda wake uishe.Expired, kiungo cha kipindi kimepitwa na wakati. Unda kipindi kipya.Webhook iliyosainiwa inawaka kwenye kila mabadiliko ya hali, kwa hivyo database yako inabaki sawa. Vipindi vilivyoachwa na vilivyokataliwa ni bure.
Data ya uzalishaji inachakatwa na kuhifadhiwa katika Umoja wa Ulaya kwa chaguo-msingi, kwenye Amazon Web Services. Mikataba ya Enterprise inaweza kuomba maeneo mbadala kwa mamlaka ambazo wadhibiti wao wanahitaji.
Usimbaji fiche kila mahali. AES-256 wakati wa kupumzika kwenye kila database, hifadhi ya vitu, na backup. Usalama wa Tabaka la Usafirishaji 1.3 wakati wa kusafirisha kwenye kila simu ya API, webhook, na kipindi cha Business Console. Data ya kibayometriki imesimbwa kwa njia fiche chini ya Ufunguo Mkuu wa Mteja tofauti.
Uhifadhi ni wako kudhibiti. Uhifadhi wa chaguo-msingi ni usio na kikomo (unlimited) isipokuwa ukisanidi mfupi zaidi, kati ya siku 30 na miaka 10 kwa kila programu, na unaweza kufuta kipindi chochote cha kibinafsi wakati wowote kutoka kwenye dashibodi au API.
Vyeti: SOC 2 Aina ya 1 & Aina ya 2, ISO/IEC 27001:2022, iBeta Kiwango cha 1 PAD, na uthibitisho wa umma kutoka Tesoro / SEPBLAC / CNMV ya Uhispania kwamba uthibitishaji wa utambulisho wa mbali wa Didit ni salama zaidi kuliko kumthibitisha mtu ana kwa ana. Ripoti kamili inapatikana kwenye /security-compliance.
Didit inatii sheria kwa chaguo-msingi kwa wadhibiti muhimu kwa miundombinu ya utambulisho:
Memo ya kina, kila cheti, kila barua ya mdhibiti: /security-compliance.
Njia tatu za kuunganisha, chagua inayofaa stack yako:
Dashibodi sawa, bili sawa, bei sawa ya kulipa kwa mafanikio kwa zote tatu. Mwongozo wa hatua kwa hatua unapatikana docs.didit.me/integration/integration-prompt.
API moja kwa KYC, KYB, Ufuatiliaji wa Miamala, na Uchunguzi wa Wallet. Unganisha ndani ya dakika 5.