Hatua ya kibayometriki katika nyakati halisi ambazo washambuliaji hulenga, uhamishaji, kuweka upya nenosiri, kuingia kwa kifaa kipya. Uamuzi chini ya sekunde mbili, karibu $0.13 kwa kila tukio. Uthibitishaji 500 bure kila mwezi.
Robinhood Ventures
Inaaminika na mashirika 2,000+ duniani kote.
Jinsi washambuliaji wanavyoshambulia
Utekaji nyara wa vitambulisho, SIM-swap, na mashambulizi ya 'stolen-session-cookie' yote hupita nywila na nambari za mara moja. Zibadilishe na hatua ya Didit wakati wa kitendo, $0.10 kwa kila simu, uamuzi chini ya sekunde mbili, 500 bure kila mwezi.
Chagua ukaguzi unaotaka, ID, liveness, ulinganishaji wa uso, vikwazo, anwani, umri, simu, barua pepe, maswali maalum. Ziburute kwenye mtiririko katika dashibodi, au tuma mtiririko huo huo kwenye API yetu. Panga masharti, fanya majaribio ya A/B, hakuna msimbo unaohitajika.
Pachika moja kwa moja na SDK yetu ya Web, iOS, Android, React Native, au Flutter. Elekeza kwenye ukurasa uliopangishwa. Au tuma tu kiungo kwa mtumiaji wako, kwa barua pepe, SMS, WhatsApp, popote. Chagua kinachofaa stack yako.
Didit inasimamia kamera, ishara za mwanga, uhamishaji wa simu, na ufikiaji. Wakati mtumiaji yuko kwenye mtiririko, tunapima ishara 200+ za udanganyifu kwa wakati halisi na kuthibitisha kila sehemu dhidi ya vyanzo vya data vya mamlaka. Matokeo chini ya sekunde mbili.
Webhooks zilizotiwa saini za wakati halisi huweka database yako sawa pindi tu mtumiaji anapoidhinishwa, kukataliwa, au kupelekwa kukaguliwa. Uliza API inapohitajika. Au fungua console kukagua kila session, kila signal, na kudhibiti kesi kwa njia yako.
Didit · Sera ya Step-up
Didit · Uthibitishaji wa Biometric
Hatua ya 2 / 2
Tuliza kwa ajili ya ukaguzi
Didit · Face Match 1:1
Jisajili
Panda ngazi
Didit · Passive Liveness
Didit · Uchambuzi wa Kifaa & IP
Didit · Webhook · X-Signature-V2
{
"session_id": "abc-…",
"vendor_data": "user-42",
"status": "Approved",
"liveness": { "status": "Approved" },
"face": { "status": "Approved",
"similarity_score": 0.94 }
}$ curl -X POST https://verification.didit.me/v3/session/ \
-H "x-api-key: $DIDIT_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"workflow_id": "wf_ato_step_up",
"vendor_data": "user-42",
"metadata": { "trigger": "high_value_transfer" },
// base64 KYC enrolment selfie, ≤ 1MB
"portrait_image": "/9j/4AAQSkZJRgABAQE..."
}'{ "session_url": "verify.didit.me/..." }// X-Signature-V2 verified upstream
if (payload.status === "Imeidhinishwa") {
unblockAction(payload.vendor_data);
} else if (payload.status === "Imekataliwa") {
logWarnings(payload.liveness.warnings);
blockAndAlert(payload.vendor_data);
}hali Imeidhinishwa · Imekataliwa · Inapitiwa · HaijakamilikaYou are integrating Didit account-takeover defence into an application that already has the user signed in. Your job: when a sensitive action fires (large transfer, password reset, payout to a new destination, new-device login, geo anomaly), gate it on a Didit biometric step-up. One API call. One signed webhook. Three branches.
WHY THIS SHAPE
- Credential stuffing, SIM-swap, and stolen-session-cookie attacks all walk past passwords and SMS one-time codes. A face check at the moment of the sensitive action does not.
- Didit runs Passive Liveness (the user is alive, present, not a deepfake) plus 1:1 Face Match against the portrait captured at sign-up. A stolen selfie cannot pass — the comparison target is locked to the original enrollment.
- $0.10 per step-up (Biometric Authentication module) + $0.03 IP pre-check (optional) = around $0.13 per event. Sub-two-second verdict on entry-level Android. 500 verifications free every month.
PRE-REQUISITES
- Production API key from https://business.didit.me (sandbox key in 60 seconds, no credit card).
- A webhook endpoint with HMAC SHA-256 verification of the X-Signature-V2 header using your webhook secret.
HMAC-SHA256 verification MUST run against the raw body bytes (the raw payload as Didit sent it) BEFORE any JSON parsing — re-serialising the parsed body changes whitespace and key order, which invalidates the signature. - A Workflow Builder workflow that bundles Passive Liveness + Face Match 1:1 (with the user's stored sign-up portrait as the comparison target). Optionally compose Device & IP Analysis ahead of the step-up to pre-gate the check.
- Persist the user's sign-up portrait — either base64 on your side, or rely on Didit's stored enrollment via vendor_data lookup.
STEP 1 — Decide WHEN to step up (your code, not Didit's)
Run your usual fraud signals. Common triggers worth a biometric step-up:
- Wire / crypto transfer above the user's daily limit
- Password / email reset on a session less than 24h old
- Payout to a bank account or wallet seen for the first time
- Login from a new device or new country
- Velocity anomaly — N actions of type T within window W
Cheap pre-check (optional, ~100ms, $0.03):
- Score the user's IP via Device & IP Analysis. If the IP is a residential trusted address with a low risk score AND the device fingerprint matches the user's trusted device, skip the step-up. Otherwise run Step 2.
STEP 2 — Create a biometric step-up session
POST https://verification.didit.me/v3/session/
Headers:
x-api-key: <your api key>
Content-Type: application/json
Body:
{
"workflow_id": "<wf id bundling Passive Liveness + Face Match 1:1>",
"vendor_data": "<your user id, max 256 chars>",
"callback": "https://<your-app>/ato/step-up/callback",
"metadata": {
"trigger": "high_value_transfer",
"action_id": "<your internal action reference>"
},
"portrait_image": "<base64 JPEG of the user's stored sign-up portrait, ≤ 1 MB — REQUIRED when the workflow has FACE_MATCH active; the step-up matches the new live selfie against this stored reference>"
}
Response: 201 Created with a hosted session URL. Redirect the user there inline (or open it in a webview / Didit mobile SDK). The action stays BLOCKED on your side until the signed webhook lands.
STEP 3 — Read the signed webhook on completion
Didit POSTs the decision to your callback. Verify X-Signature-V2 (HMAC SHA-256 of the raw request body using your webhook secret) BEFORE reading the JSON.
Payload (excerpted):
{
"session_id": "<uuid>",
"vendor_data": "<your user id>",
"status": "Approved",
"liveness": { "status": "Approved" },
"face": { "status": "Approved", "similarity_score": 0.94 },
"ip_analysis": { "status": "Approved", "score": 11 }
}
Session status enum (exact case, Title Case With Spaces): Approved | Declined | In Review | Resubmitted | Expired | Not Finished | Kyc Expired | Abandoned.
STEP 4 — Branch the original action on status
Approved → unblock the sensitive action. Log session_id + similarity score on the audit trail.
In Review → hold the action, route to a human review queue.
Declined → block the action, log liveness warnings (mask / deepfake / replay / morph), alert the user.
Not Finished → invite the user to retry with a fresh session URL.
Expired → resend the link; the original session has timed out.
Abandoned → the user closed the flow before completing; resend the link.
STEP 5 — (Optional) Pull the full decision payload
GET https://verification.didit.me/v3/session/{session_id}/decision/
Headers:
x-api-key: <your api key>
Returns the same payload as the webhook plus the structured signals (liveness warnings, face-match similarity, IP / device flags). Use for analyst review.
WEBHOOK EVENT NAMES
- Sessions: standard session webhook (one endpoint, status field tells you where in the lifecycle).
- Verify X-Signature-V2 (HMAC SHA-256) on every payload.
CONSTRAINTS
- Session statuses use Title Case With Spaces (Approved, In Review). Never use UPPER_SNAKE_CASE for session verdicts — that's the Transactions API and lives in a different surface.
- 1:1 face match's comparison target is the user's STORED sign-up portrait, not a freshly captured one. A stolen selfie cannot pass.
- iBeta Level 1 Presentation Attack Detection (PAD) certified against the full ISO/IEC 30107-3 catalogue — print, replay, paper / silicone / latex mask, deepfake, morph.
- The Workflow Builder is where you choose the modules in the step-up — change them in the console without redeploying.
- 200+ fraud signals are surfaced on every session at no extra cost — read them off the decision payload, don't re-query.
Read the docs:
- https://docs.didit.me/sessions-api/create-session
- https://docs.didit.me/core-technology/biometric-auth/overview
- https://docs.didit.me/core-technology/ip-analysis/overview
- https://docs.didit.me/integration/webhooks
Start free at https://business.didit.me — sandbox key in 60 seconds, 500 verifications free every month, no credit card.$0 / mwezi. Hakuna kadi ya mkopo inayohitajika.
Lipa tu kwa unachotumia. Moduli 25+. Bei za umma kwa kila moduli, hakuna ada ya chini ya kila mwezi.
MSA & SLA maalum. Kwa idadi kubwa na programu zilizodhibitiwa.
Anza bure → lipa tu wakati ukaguzi unafanyika → fungua Enterprise kwa mkataba maalum, SLA, au uhifadhi wa data.
Didit ni miundombinu ya utambulisho na udanganyifu, jukwaa ambalo tulitamani lingekuwepo tulipokuwa tukijenga bidhaa zetu wenyewe: wazi, rahisi, na rafiki kwa watengenezaji, ili lifanye kazi kama sehemu halisi ya stack yako badala ya "black box" unayounganisha.
API moja inashughulikia kuthibitisha watu (KYC, mjue mteja wako), kuthibitisha biashara (KYB, mjue biashara yako), kuchunguza pochi za crypto (KYT, mjue muamala wako), na kufuatilia miamala kwa wakati halisi, kwenye stack iliyojengwa kuwa:
Msingi wake: aina 14,000+ za hati katika lugha 48+, vyanzo vya data 1,000+, na ishara za udanganyifu 200+ kwenye kila kipindi. Miundombinu ya Didit hujifunza kwa nguvu kutoka kila kipindi na inaboreshwa kila siku.
Udhibiti wa akaunti (ATO) hutokea wakati mshambuliaji anapata udhibiti wa akaunti halali ya mtumiaji, kwa kawaida kwa kutumia vitambulisho vilivyoibiwa, "session cookie" iliyotekwa, au "SIM-swap" inayopokea Nenosiri la Mara Moja (OTP). Kutoka hapo huondoa pesa kwenye pochi, huhamisha fedha, hubadilisha maelezo ya malipo, au huweka upya barua pepe na kumzuia mmiliki halisi kuingia.
Shambulio hilo hupita nenosiri kwa sababu nenosiri tayari ni sahihi. Hupita msimbo wa Short Message Service (SMS) kwa sababu mshambuliaji anadhibiti namba ya simu. Ulinzi ni kukatisha wakati wa hatua kwa kitu ambacho mshambuliaji hana, uso wa mtumiaji halali.
Kwa sababu udanganyifu wa SIM-swap huweka msimbo wa Short Message Service (SMS) kwenye mfuko wa mshambuliaji. Mshambuliaji humshawishi mtoa huduma kuhamisha namba ya mwathirika kwenye Subscriber Identity Module (SIM) mpya; kuanzia hapo, kila msimbo ambao benki hutuma hufika kwenye simu ya mshambuliaji.
"Phishing kits" za 2026 pia huhamisha msimbo kwa wakati halisi, mtumiaji huuchapa kwenye ukurasa bandia, kit huurudia kwenye tovuti halisi, kipindi hufunguka. SMS hutoa siri moja inayoshirikiwa kwa kila chaneli; biometrics hutoa uthibitisho wa kila hatua unaohusishwa na binadamu aliye mbele ya kamera.
Mchakato mzima kwa kawaida huchukua chini ya sekunde 30 kuanzia mwanzo hadi mwisho, chukua kitambulisho, piga picha hati, piga picha ya selfie, umemaliza. Huu ndio mchakato wa haraka zaidi sokoni. Watoa huduma wa zamani wa KYC kwa kawaida huchukua zaidi ya sekunde 90 kwa mchakato huo huo.
Kwa upande wa "back end", Didit hurejesha matokeo kwa chini ya sekunde mbili kwa p99, ikipimwa kuanzia wakati mtumiaji anamaliza selfie hadi wakati webhook yako inapoanza. Upigaji picha wa simu umeboreshwa kwa simu za polepole na mitandao ya polepole: "progressive image compression", upakiaji wa "lazy software development kit", na uhamishaji wa kugusa mara moja kutoka kompyuta hadi simu kupitia msimbo wa QR ikiwa mtumiaji anaanza kwenye wavuti.
Usajili hunasa utambulisho wa mtumiaji kwa mara ya kwanza, hati ya utambulisho ya serikali, Optical Character Recognition (OCR), Passive Liveness, na picha inayoanza kuwa msingi wa usajili. Ni mchakato mzito, wa mara moja.
Step-up ni toleo jepesi, linaloweza kurudiwa. Injini ile ile ya "liveness" huendeshwa kwenye selfie mpya; Face Match 1:1 hulinganisha selfie mpya na picha iliyohifadhiwa ya usajili. Hakuna hati ya utambulisho, hakuna OCR. Chini ya sekunde mbili, $0.10 kwa kila kipindi.
Kila kipindi huishia kwenye mojawapo ya hali saba zilizo wazi, hivyo code yako daima inajua nini cha kufanya:
Approved, kila ukaguzi umefaulu. Endeleza mtumiaji.Declined, ukaguzi mmoja au zaidi umeshindwa. Unaweza kumruhusu mtumiaji kutuma upya hatua maalum iliyoshindwa (kwa mfano, kupiga tena selfie) bila kuendesha upya mchakato mzima.In Review, imewekwa alama kwa ukaguzi wa kufuata sheria. Fungua kesi kwenye console, angalia kila ishara, amua kuidhinisha au kukataa.In Progress, mtumiaji yuko katikati ya mchakato.Not Started, kiungo kimetumwa, mtumiaji bado hajafungua. Tuma ukumbusho ikiwa itakaa muda mrefu sana.Abandoned, mtumiaji alifungua kiungo lakini hakumaliza kwa wakati. Mshirikishe tena au muda wake uishe.Expired, kiungo cha kipindi kimepitwa na wakati. Unda kipindi kipya.Webhook iliyosainiwa huwashwa kwenye kila mabadiliko ya hali, hivyo database yako daima inabaki sawa. Vipindi vilivyoachwa na vilivyokataliwa ni bure.
Data ya uzalishaji inachakatwa na kuhifadhiwa katika Umoja wa Ulaya kwa chaguo-msingi, kwenye Amazon Web Services. Mikataba ya biashara inaweza kuomba maeneo mbadala kwa mamlaka ambazo wadhibiti wao wanahitaji.
Usimbaji fiche kila mahali. AES-256 ikiwa imetulia kwenye kila database, hifadhi ya vitu, na "backup". Transport Layer Security 1.3 ikiwa inahamishwa kwenye kila API call, webhook, na kipindi cha Business Console. Data ya kibayometriki imesimbwa kwa kutumia Customer Master Key tofauti.
Uhifadhi ni wako kudhibiti. Uhifadhi wa chaguo-msingi ni usio na kikomo (unlimited) isipokuwa ukisanidi muda mfupi, kati ya siku 30 na miaka 10 kwa kila programu, na unaweza kufuta kipindi chochote cha kibinafsi wakati wowote kutoka kwenye dashibodi au API.
Vyeti: SOC 2 Type 1 (ukaguzi wa Type 2 unaendelea), ISO/IEC 27001:2022, iBeta Level 1 PAD, na uthibitisho wa umma kutoka Tesoro / SEPBLAC / CNMV ya Uhispania kwamba uthibitishaji wa utambulisho wa mbali wa Didit ni salama zaidi kuliko kumthibitisha mtu ana kwa ana. Ripoti kamili inapatikana /security-compliance.
Didit inatii sheria kwa chaguo-msingi kwa wadhibiti muhimu kwa miundombinu ya utambulisho:
Memo ya kina, kila cheti, kila barua ya mdhibiti: /security-compliance.
Njia tatu za kuunganisha, chagua inayofaa stack yako:
Dashibodi ile ile, bili ile ile, bei ile ile ya kulipa kwa mafanikio kwa zote tatu. Mwongozo wa hatua kwa hatua unapatikana docs.didit.me/integration/integration-prompt.
Fanya Uchambuzi wa Kifaa na IP kabla ya "step-up". $0.03 kwa kila ukaguzi, chini ya 100ms, hurejesha alama ya hatari ya 0–100 pamoja na bendera za Virtual Private Network (VPN), "proxy", The Onion Router (Tor), "datacenter", nchi, na Autonomous System Number (ASN).
Ikiwa mtandao unaonekana safi (Internet Service Provider (ISP) ya makazi, "device fingerprint" inayoaminika, hakuna mabadiliko ya nchi), ruka uthibitisho wa uso. Ikiwa alama ni ya juu au bendera yoyote inawaka, fanya "step-up". Hiyo huweka bajeti ya kibayometriki kwenye matukio ambayo yanahitaji kweli.
Vipengele viwili:
Karibu $0.13 kwa kila hatua nyeti iliyochunguzwa kikamilifu. Uthibitishaji 500 wa kwanza kila mwezi ni bure kwenye kila akaunti, timu nyingi hugundua kuwa kiasi chao cha "step-up" kinakaa ndani ya posho hiyo kwa wiki chache za kwanza.
Hakuna kiwango cha chini, hakuna ahadi ya kila mwaka, hakuna bei kwa kila kiti.
"Recipe" hii inatumika kwa timu yoyote inayoshughulikia hatua zenye thamani kubwa. Mifumo ya kawaida inayotumika:
Workflow Builder ile ile, "triggers" tofauti, muunganisho mmoja, mstari mmoja wa bei.
API moja kwa KYC, KYB, Ufuatiliaji wa Miamala, na Uchunguzi wa Wallet. Unganisha ndani ya dakika 5.