Gonga e-pasipoti au e-ID kwenye simu. Inasoma chip, inathibitisha saini ya serikali, inagundua udanganyifu ambao ukaguzi wa picha wa kawaida hukosa. $0.15 kwa usomaji, 500 bila malipo/mwezi.
Robinhood Ventures
ICAO 9303
Gonga pasipoti. Chip inarudisha data sawa na picha, isipokuwa wakati huu imesainiwa na nchi iliyotoa. $0.15, chini ya sekunde 2.
Chagua ukaguzi unaotaka, Kitambulisho, liveness, ulinganishaji wa uso, vikwazo, anwani, umri, simu, barua pepe, maswali maalum. Ziburute kwenye mtiririko kwenye dashibodi, au tuma mtiririko huo huo kwenye API yetu. Panga masharti, fanya majaribio ya A/B, hakuna msimbo unaohitajika.
Pachika asili na SDK yetu ya Web, iOS, Android, React Native, au Flutter. Elekeza kwenye ukurasa uliopangishwa. Au tuma tu mtumiaji wako kiungo, kwa barua pepe, SMS, WhatsApp, popote. Chagua kinachofaa stack yako.
Didit inakaribisha kamera, vidokezo vya mwanga, uhamishaji wa simu, na ufikiaji. Wakati mtumiaji yuko kwenye mtiririko, tunapata alama za ishara 200+ za udanganyifu kwa wakati halisi na kuthibitisha kila sehemu dhidi ya vyanzo vya data vya mamlaka. Matokeo chini ya sekunde mbili.
Webhooks zilizosainiwa kwa wakati halisi huweka database yako sawa mara tu mtumiaji anapoidhinishwa, kukataliwa, au kutumwa kwa ukaguzi. Piga API inapohitajika. Au fungua console kukagua kila kikao, kila ishara, na kudhibiti kesi kwa njia yako.
NFC · ICAO 9303
SOD · DG1 · DG2 · DG7 · DG11–14
DSC → CSCA → ICAO PKD
nfc.chip_data + uhalisi
{
"nfc": {
"status": "Imeidhinishwa",
"chip_data": {
"document_number": "SAMPLE12345",
"issuing_country": "ESP",
"first_name": "OLIVIA",
"last_name": "DOE"
},
"authenticity": {
"sod_integrity": true,
"dg_integrity": true
},
"warnings": []
}
}Native SDKs · auto-fallback
Inaburudishwa kiotomatiki
Pasipoti tangu
Vitambulisho vya kielektroniki vya kitaifa
Kiwango cha 9303
Inajisasisha kiotomatiki
$ curl -X POST https://verification.didit.me/v3/session/ \
-H "x-api-key: $DIDIT_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"workflow_id": "wf_id_nfc",
"vendor_data": "user-42"
}'{ "session_url": "verify.didit.me/..." }// iOS · Swift
import DiditSdk
let result = jaribu kusubiri DiditSdk.shared.startVerification(
na: sessionId,
usanidi: config
){ "hali": "Imeidhinishwa" }# Didit NFC Verification — integrate in 5 minutes
You are integrating Didit's NFC Verification (cryptographic e-passport
and e-ID chip reading) module into <my_stack>. Follow these steps exactly.
Every URL, header, and enum value below is canonical — do not paraphrase
or "improve" them.
## 1. Provision an account
- Sign up: https://business.didit.me (no credit card required).
- Or provision programmatically: POST https://apx.didit.me/auth/v2/programmatic/register/
(returns an API key bound to the workspace + application).
## 2. What NFC Verification actually does
NFC Verification reads the secure contact-less chip embedded in modern
e-passports and e-IDs (the small chip-and-antenna sticker symbol on the
cover) and runs four cryptographic checks against the data it extracts:
1. Passive Authentication — every Data Group (DG1 personal data, DG2
facial image, etc.) is hashed and compared against the signed hash
stored in the Document Security Object (SOD). Catches any single-bit
tampering of the chip contents.
2. Certificate chain validation — Document Signer Certificate (DSC) →
Country Signing Certificate Authority (CSCA) → ICAO Public Key
Directory (PKD) root. Proves the chip was signed by the issuing
government, not a clone.
3. Certificate Revocation List (CRL) check — DSCs revoked by the issuing
country are caught and flagged.
4. Chip Authentication — where the document supports it, prevents chip
cloning by challenging the chip with a key-pair handshake.
PACE (Password Authenticated Connection Establishment) or BAC (Basic
Access Control) is used to derive the session key from the Machine-Readable Zone (MRZ); Didit
handles that automatically. All of this is ICAO 9303 standard.
## 3. Two integration paths — pick one
### Path A — Workflow Builder (hosted UI, REQUIRED for NFC)
NFC Verification has no server-to-server standalone endpoint. The chip
has to be read by a device with NFC hardware, so you always integrate
through the Workflow + native SDK (or hosted mobile web that falls back).
1. Create a workflow that contains the NFC feature:
POST https://verification.didit.me/v3/workflows/
Authorization header: x-api-key: <your-api-key>
Body: workflow_label, features array with the entries
{ feature: "ID_VERIFICATION" }
{ feature: "NFC" }
(UPPERCASE — strict enum)
You should always pair NFC with ID_VERIFICATION so the MRZ is captured
for the chip handshake AND so an OCR cross-validation is available.
2. Create a verification session for an end user:
POST https://verification.didit.me/v3/session/
Body: workflow_id (from step 1), vendor_data (your own user id).
Response: session_url — redirect the user to it (or open it in the
native SDK with shared.startVerification(with: sessionId)).
3. Listen for webhook callbacks (see "Webhooks" below).
### Path B — Native SDKs (drop-in, recommended for mobile apps)
Same workflow + session above, but launch the verification flow in your
own iOS or Android app via the Didit SDK. The SDK wires the NFC reader,
the entitlements, and the chip-reading UI for you.
- iOS: DiditSdk.shared.startVerification(with: sessionId, configuration:)
Required entitlements (handled by the SDK):
- com.apple.developer.nfc.readersession.formats = ["TAG"]
- ISO7816 application identifiers for ePassports
- Android: DiditSdk.startVerification(sessionId, config) — uses
IsoDep (android.nfc.tech.IsoDep) under the hood.
- React Native / Flutter: the same SDK, exposed through the cross-
platform module — see docs.didit.me/integration/native-sdks/.
### Web browsers — NFC is unavailable
Web NFC API is not generally available. Chrome on Android has an
experimental Web NFC that is unstable and requires explicit permissions;
Safari on iOS has no support. For web integrations, NFC is automatically
skipped and the user proceeds with standard ID + selfie. If you require
NFC, deep-link the user into the Didit App or your own native app.
## 4. Webhooks
- Register a webhook destination once via
POST https://verification.didit.me/v3/webhook/destinations/
Body: url, subscribed_events: ["session.verified", "session.review_started",
"session.declined"]
- Response includes secret_shared_key — store it.
- Every webhook delivery carries an X-Signature-V2 header you MUST verify
before trusting the payload. HMAC-SHA256 verification MUST run against the raw body bytes (the raw payload as Didit sent it) BEFORE any JSON parsing — re-serialising the parsed body changes whitespace and key order, which invalidates the signature.Algorithm:
1. sortKeys(payload) recursively
2. shortenFloats (truncate trailing zeros after the decimal point)
3. JSON.stringify the result
4. HMAC-SHA256 with the secret_shared_key
5. Hex-encode, compare to the X-Signature-V2 header.
## 5. Reading the report
The session report includes an nfc object alongside the id_verification
object. Top-level fields on nfc:
- status: "Approved" | "Declined" | "In Review" | "Not Finished"
- portrait_image: signed URL to the chip-extracted DG2 facial image
- signature_image: signed URL to the chip-extracted DG7 signature
- chip_data:
document_type, issuing_country (ISO 3166-1 alpha-3),
document_number, expiration_date (YYYY-MM-DD),
first_name, last_name, birth_date, gender ("M" | "F" | "U"),
nationality (ISO 3166-1 alpha-3), address, place_of_birth.
- authenticity:
sod_integrity (boolean — every Data Group hash matched the SOD)
dg_integrity (boolean — Data Group binary integrity check passed)
- certificate_summary:
issuer (CSCA Common Name + serial + organization + country)
subject (DSC Common Name)
serial_number
not_valid_after (YYYY-MM-DD HH:MM:SS)
not_valid_before (YYYY-MM-DD HH:MM:SS)
- warnings: Array of { risk, additional_data, log_type,
short_description, long_description }
### Auto-decline (always enforced, never configurable)
- NFC_AND_OCR_DATA_NOT_SAME — Optical Character Recognition (OCR) data
and chip data differ. Indicates document tampering or fake chip.
### Configurable warnings (per-workflow action: Decline / Review / Approve)
- SKIPPED_NFC_VALIDATION — chip not read (no NFC hardware, no
permissions, document has no chip)
- NFC_CHIP_NOT_VERIFIED — chip read but signature could not be
verified (missing CSCA, older document)
- DSC_CERTIFICATE_REVOKED — Document Signer Certificate listed on
the issuing country's CRL
- DSC_CERTIFICATE_EXPIRED — Document Signer Certificate past its
validity period
## 6. Hard rules — do not change
- Base URL for /v3/* endpoints is verification.didit.me (NOT apx.didit.me).
- Feature enum is UPPERCASE: NFC, ID_VERIFICATION, LIVENESS, FACE_MATCH.
- Auth header is x-api-key (lowercase, hyphenated).
- Webhook signature header is X-Signature-V2 (NOT X-Signature).
- Always verify webhook signatures before trusting payload data.
- Always pair NFC with ID_VERIFICATION in the workflow — NFC alone
cannot derive the chip key without the MRZ from the document photo.
- Status casing matches exactly: "Approved", "Declined", "In Review",
"Not Finished" (title-cased, space-separated).
- Treat NFC as an additive confidence boost, not a hard gate, unless
your risk policy explicitly requires it (regulated remote
onboarding under PSD3, AMLD6 high-risk customer flows, etc.).
## 7. Pricing reference (public)
- NFC Verification: $0.15 per chip read (standalone module).
- Bundled inside a full Know Your Customer (KYC) workflow (ID + Liveness + Face Match + NFC):
priced as the underlying KYC bundle ($0.33) + $0.15 NFC if enabled.
- 500 free checks every month, forever, on every account.
## 8. Verify your integration
- Sandbox starts on signup at https://business.didit.me — no separate flag.
- Test documents: use the Didit App on a real iOS or Android device with
any ICAO 9303 e-passport issued after 2006 (most modern passports).
- Sandbox webhook events fire the same shape as production; verify the
X-Signature-V2 header in dev too.
- Switch to live: flip the application's environment toggle in console.
When in doubt: https://docs.didit.me/core-technology/nfc-verification/overview
$0 / mwezi. Hakuna kadi ya mkopo inayohitajika.
Lipa tu kwa unachotumia. Moduli 25+. Bei za umma kwa kila moduli, hakuna ada ya chini ya kila mwezi.
MSA & SLA maalum. Kwa idadi kubwa na programu zilizodhibitiwa.
Anza bure → lipa tu wakati ukaguzi unafanyika → fungua Enterprise kwa mkataba maalum, SLA, au uhifadhi wa data.
Didit ni miundombinu ya utambulisho na udanganyifu, jukwaa ambalo tulitamani lingekuwepo tulipokuwa tukijenga bidhaa sisi wenyewe: wazi, rahisi, na rafiki kwa waendelezaji, ili lifanye kazi kama sehemu halisi ya stack yako badala ya black box unayounganisha.
API moja inashughulikia kuthibitisha watu (KYC, mjue mteja wako), kuthibitisha biashara (KYB, ijue biashara yako), kuchunguza pochi za crypto (KYT, ijue muamala wako), na kufuatilia miamala kwa wakati halisi, kwenye stack iliyojengwa kuwa:
Upeo wake: aina 14,000+ za nyaraka katika lugha 48+, vyanzo vya data 1,000+, na ishara za udanganyifu 200+ kwenye kila kipindi. Miundombinu ya Didit hujifunza kwa nguvu kutoka kila kipindi na inaboreshwa kila siku.
docs.didit.me/core-technology/nfc-verification/supported-documents-nfc-verification. Chip inasomwa kwa kutumia PACE (Password Authenticated Connection Establishment) au BAC (Basic Access Control), Didit hupata ufunguo wa kipindi kutoka Machine Readable Zone (MRZ) kiotomatiki, hivyo mtumiaji anahitaji tu kugonga hati yake kwenye simu.nfc pamoja na kitu cha id_verification. status ya ngazi ya juu ni mojawapo ya Approved, Declined, In Review, au Not Finished. Kitu hicho pia kinajumuisha block ya chip_data (document_type, issuing_country katika ISO 3166-1 alpha-3, document_number, expiration_date, first_name, last_name, birth_date, gender, nationality, address, place_of_birth), block ya authenticity (sod_integrity, dg_integrity), certificate_summary (issuer, subject, serial_number, not_valid_after, not_valid_before), URL zilizotiwa saini kwa portrait_image (picha ya uso ya DG2 iliyotolewa kutoka chip) na signature_image (picha ya saini ya DG7 iliyotolewa kutoka chip), na array ya warnings. Marejeleo kamili yanapatikana docs.didit.me/core-technology/nfc-verification/report-nfc-verification.Mchakato mzima kwa kawaida huchukua chini ya sekunde 30 kuanzia mwanzo hadi mwisho, chukua kitambulisho, piga picha hati, piga selfie, umemaliza. Huu ndio mchakato wa haraka zaidi sokoni. Watoa huduma wa zamani wa KYC kwa kawaida huchukua zaidi ya sekunde 90 kwa mchakato huo huo.
Kwenye upande wa nyuma, Didit inarudisha matokeo kwa chini ya sekunde mbili kwa p99, ikipimwa kuanzia wakati mtumiaji anamaliza selfie hadi wakati webhook yako inawaka. Upigaji picha wa simu umeboreshwa kwa simu za polepole na mitandao ya polepole: ukandamizaji wa picha unaoendelea, upakiaji wa SDK wa polepole, na uhamishaji wa haraka kutoka desktop kwenda simu kupitia QR code ikiwa mtumiaji anaanza kwenye wavuti.
Kila kipindi huishia kwenye mojawapo ya hali saba zilizo wazi, hivyo code yako inajua nini cha kufanya kila wakati:
Approved, kila ukaguzi umefaulu. Endeleza mtumiaji.Declined, ukaguzi mmoja au zaidi umeshindwa. Unaweza kumruhusu mtumiaji kutuma tena hatua maalum iliyoshindwa (kwa mfano, piga tena selfie) bila kurudia mchakato mzima.In Review, imewekwa alama kwa ukaguzi wa kufuata. Fungua kesi kwenye console, angalia kila ishara, amua kuidhinisha au kukataa.In Progress, mtumiaji yuko katikati ya mchakato.Not Started, kiungo kimetumwa, mtumiaji bado hajafungua. Tuma ukumbusho ikiwa itakaa muda mrefu sana.Abandoned, mtumiaji alifungua kiungo lakini hakumaliza kwa wakati. Mshirikishe tena au muda wake uishe.Expired, kiungo cha kipindi kimeisha muda wake. Unda kipindi kipya.Webhook iliyotiwa saini inawaka kwenye kila mabadiliko ya hali, hivyo database yako inabaki sawa kila wakati. Vipindi vilivyoachwa na vilivyokataliwa ni bure.
Data ya uzalishaji inachakatwa na kuhifadhiwa katika Umoja wa Ulaya kwa chaguo-msingi, kwenye Amazon Web Services. Mikataba ya biashara inaweza kuomba maeneo mbadala kwa mamlaka ambazo wadhibiti wao wanahitaji.
Usimbaji fiche kila mahali. AES-256 wakati wa kupumzika kwenye kila database, hifadhi ya kitu, na backup. Usalama wa Tabaka la Usafiri 1.3 wakati wa usafiri kwenye kila simu ya API, webhook, na kipindi cha Business Console. Data ya kibayometriki imesimbwa kwa kutumia Ufunguo Mkuu wa Mteja tofauti.
Uhifadhi ni wako kudhibiti. Uhifadhi wa chaguo-msingi ni usio na kikomo (usio na ukomo) isipokuwa ukisanidi muda mfupi, kati ya siku 30 na miaka 10 kwa kila programu, na unaweza kufuta kipindi chochote cha kibinafsi wakati wowote kutoka kwenye dashibodi au API.
Vyeti: SOC 2 Aina ya 1 (ukaguzi wa Aina ya 2 unaendelea), ISO/IEC 27001:2022, iBeta Level 1 PAD, na uthibitisho wa umma kutoka Tesoro / SEPBLAC / CNMV ya Uhispania kwamba uthibitishaji wa utambulisho wa mbali wa Didit ni salama zaidi kuliko kumthibitisha mtu ana kwa ana. Ripoti kamili inapatikana /security-compliance.
Didit inatii sheria kwa chaguo-msingi kwa wadhibiti muhimu kwa miundombinu ya utambulisho:
Memo ya kina, kila cheti, kila barua ya mdhibiti: /security-compliance.
Njia tatu za kuunganisha, chagua inayofaa stack yako:
Dashibodi sawa, bili sawa, bei sawa ya kulipa-kwa-mafanikio kwa zote tatu. Mwongozo wa hatua kwa hatua unapatikana docs.didit.me/integration/integration-prompt.
API moja kwa KYC, KYB, Ufuatiliaji wa Miamala, na Uchunguzi wa Wallet. Unganisha ndani ya dakika 5.