Imarisha mifumo nyeti kwa uthibitisho wa uso unaochukua chini ya sekunde 2 dhidi ya picha iliyosajiliwa. Inazuia phishing. Inazuia SIM-swap. $0.10 kwa uthibitisho. Uthibitishaji 500 bila malipo kila mwezi.
Robinhood Ventures
Inaaminika na mashirika 2,000+ duniani kote.
Inazuia phishing · Inazuia SIM-swap
Kipengele cha pili ni uso wa mtumiaji, unaolinganishwa 1:1 na picha waliyosajili wakati wa kujisajili. Liveness inazuia shambulio la kuchapisha / kucheza tena / barakoa / Generative Adversarial Network (GAN) kwenye fremu hiyo hiyo. Uamuzi wa chini ya sekunde 2 kwenye Android ya kiwango cha chini. $0.10 kwa uthibitisho. Uthibitishaji 500 bila malipo kila mwezi.
Chagua ukaguzi unaotaka, kitambulisho, liveness, kulinganisha uso, vikwazo, anwani, umri, simu, barua pepe, maswali maalum. Ziburute kwenye mtiririko kwenye dashibodi, au tuma mtiririko huo huo kwenye API yetu. Panga masharti, fanya majaribio ya A/B, hakuna msimbo unaohitajika.
Pachika asili na SDK yetu ya Web, iOS, Android, React Native, au Flutter. Elekeza kwenye ukurasa uliopangishwa. Au tuma tu kiungo kwa mtumiaji wako, kwa barua pepe, SMS, WhatsApp, popote. Chagua kinachofaa stack yako.
Didit inasimamia kamera, ishara za mwanga, uhamishaji wa simu, na ufikiaji. Wakati mtumiaji yuko kwenye mtiririko, tunapima ishara 200+ za udanganyifu kwa wakati halisi na kuthibitisha kila sehemu dhidi ya vyanzo vya data vya mamlaka. Matokeo chini ya sekunde mbili.
Webhooks zilizosainiwa kwa wakati halisi huweka database yako sawa mara tu mtumiaji anapoidhinishwa, kukataliwa, au kutumwa kwa ukaguzi. Piga API inapohitajika. Au fungua console kukagua kila kikao, kila ishara, na kudhibiti kesi zako mwenyewe.
Didit · Uthibitishaji wa Biometric
Thibitisha uhamisho
Onyesha uso wako ili uidhinishe
Didit · Face Match 1:1
Amesajiliwa
Kufanana
0.96
LinganishaMoja kwa moja
Didit · Attack matrix
Didit · Vichochezi vya Step-up
Didit · Webhook · X-Signature-V2
Payload
{
"session_id": "<uuid>",
"vendor_data": "user-42",
"status": "Approved",
"face": {
"status": "Approved",
"similarity_score": 0.96
}
}Didit · Uchumi
$ curl -X POST https://verification.didit.me/v3/session/ \
-H "x-api-key: $DIDIT_API_KEY" \
-d '{
"workflow_id": "wf_bio_2fa",
"workflow_type": "biometric_authentication",
"vendor_data": "user-42",
// base64 reference selfie, ≤ 1MB (omit for liveness-only)
"portrait_image": "/9j/4AAQSkZJRgABAQE..."
}'{ "session_url": "verify.didit.me/..." }$ curl -X POST https://verification.didit.me/v3/face-match/ \
-H "x-api-key: $DIDIT_API_KEY" \
-F "image_a=@live.jpg" \
-F "image_b=@enrolled.jpg"{ "hali": "Imeidhinishwa", "alama_ya_kufanana": 0.96 }You are integrating Didit's Biometric 2FA into <my_stack>. Replace SMS one-time-password (OTP) on sensitive flows — login from a new device, large-value transfer, settings change, account recovery — with a sub-2-second face match against the user's enrolled portrait. Cheaper than SMS. Phishing-resistant. SIM-swap-proof.
1. Enrol the user's portrait ONCE at sign-up via the standard Know Your Customer (KYC) session.
2. On every sensitive action, open a Biometric Authentication session that runs Passive Liveness + Face Match 1:1 against the stored portrait. Verdict in sub-2-seconds.
Pricing (public):
- Biometric Authentication: $0.10 per authentication (Sessions API)
- Standalone Face Match 1:1: $0.05 per match (server-to-server)
- First 500 verifications free every month, forever
PRE-REQUISITES
- Production API key from https://business.didit.me (sandbox key in 60s, no card).
- Webhook endpoint with Hash-based Message Authentication Code (HMAC) SHA-256 verification using the X-Signature-V2 header.
- The user has previously enrolled — either via a full KYC session (recommended; the portrait is stored automatically and never leaves Didit) or via a portrait you supply on each re-auth.
- A workflow_id from the Workflow Builder. The workflow MUST contain LIVENESS, and the session must be opened with workflow_type = "biometric_authentication" (or use a workflow that has FACE_MATCH and pass a portrait_image at session creation).
STEP 1 — Enrolment (one-time, at user sign-up)
Run a standard KYC session at sign-up. Didit stores the portrait (the face captured during the liveness step) as the user's enrolled template, bound to vendor_data.
POST https://verification.didit.me/v3/session/
Body:
{
"workflow_id": "<your KYC workflow>",
"vendor_data": "<your user id>"
}
No additional code — once the user passes KYC, their enrolled portrait is ready for every future re-auth.
STEP 2 — Re-authentication (on every sensitive action)
POST https://verification.didit.me/v3/session/
Headers:
x-api-key: <your api key>
Content-Type: application/json
Body:
{
"workflow_id": "<your biometric_authentication workflow>",
"workflow_type": "biometric_authentication",
"vendor_data": "<the same user id used at enrolment>",
"callback": "https://<your-app>/2fa/callback",
"metadata": {
"reason": "<login_new_device | high_value_txn | settings_change | account_recovery>",
"amount": "<optional, for large-value transfers>"
},
"portrait_image": "<base64 JPEG of the user's enrolment selfie, ≤ 1 MB — REQUIRED when the workflow has FACE_MATCH active; OMIT for liveness-only mode>"
}
Response: 201 Created with the hosted session_url. Redirect the user to it. The hosted UI:
- Opens the front camera
- Captures one passive frame
- Runs Liveness + Face Match 1:1 against the user's enrolled portrait
- Returns the verdict in sub-2-seconds
STEP 3 — Read the signed verdict on the webhook
Body (excerpted for a passing re-auth):
{
"session_id": "<uuid>",
"vendor_data": "<your user id>",
"status": "Approved",
"liveness": { "status": "Approved", "method": "PASSIVE", "score": 96 },
"face": {
"status": "Approved",
"similarity_score": 0.96
}
}
Verify X-Signature-V2 BEFORE trusting the body — HMAC SHA-256 of the raw bytes with your webhook secret.
Session status enum (exact case): Approved | Declined | In Review | Resubmitted | Expired | Not Finished | Kyc Expired | Abandoned.
Branch your application:
Approved → execute the action (sign in, release the transfer, save settings).
Declined → block the action, re-prompt with a higher-friction recovery path (support contact / KYC re-do).
In Review → hold; route to your operations queue.
Not Finished → user abandoned the capture; safe to re-prompt or fall back.
STEP 4 — Alternate path (server-to-server, when you already have the selfie)
If you already captured the selfie locally (native mobile SDK, in-app camera):
POST https://verification.didit.me/v3/face-match/
Headers:
x-api-key: <your api key>
Body (multipart/form-data):
image_a <the live selfie>
image_b <the enrolled portrait>
Response: similarity_score (0-1), status (Approved | Declined | In Review).
Use the standalone path only when you trust your client-side capture pipeline. For browser flows or any surface where the SDK is not embedded, always prefer the hosted session — Didit's liveness check is harder to defeat than a raw camera grab.
WEBHOOK EVENT NAMES
- Sessions: status changes flow through the standard session webhook.
- Always verify X-Signature-V2 on every payload.
CONSTRAINTS
- Base URL for /v3/* endpoints is verification.didit.me (NOT apx.didit.me).
- Feature enum is UPPERCASE: LIVENESS, FACE_MATCH, ID_VERIFICATION, AML, IP_ANALYSIS, AGE_ESTIMATION.
- Method enum is UPPERCASE: PASSIVE, FLASHING, ACTIVE_3D.
- Auth header is x-api-key (lowercase, hyphenated).
- Webhook signature header is X-Signature-V2 (NOT X-Signature).
- Status casing matches exactly: Approved, Declined, In Review, Expired, Not Finished, Resubmitted, Kyc Expired, Abandoned.
- The biometric template is irreversible (a one-way hash) and stored on Didit's infrastructure. You never receive the raw template. Standard data-subject-deletion rules apply.
PRO TIPS
- Pair Biometric 2FA with Device & IP Analysis (bundled into the 200+ fraud-signal stack). A re-auth that originates from a brand-new device + a brand-new IP should always step up to face.
- For the strongest possible surface, swap method PASSIVE for ACTIVE_3D — a short motion challenge — on transfers above your operational risk threshold.
Read the docs:
- https://docs.didit.me/core-technology/biometric-auth/overview
- https://docs.didit.me/sessions-api/create-session
- https://docs.didit.me/integration/webhooks
Start free at https://business.didit.me — sandbox key in 60 seconds, 500 verifications free every month, no credit card.$0 / mwezi. Hakuna kadi ya mkopo inayohitajika.
Lipa tu kwa unachotumia. Moduli 25+. Bei za umma kwa kila moduli, hakuna ada ya chini ya kila mwezi.
MSA & SLA maalum. Kwa idadi kubwa na programu zilizodhibitiwa.
Anza bure → lipa tu wakati ukaguzi unafanyika → fungua Enterprise kwa mkataba maalum, SLA, au uhifadhi wa data.
Didit ni miundombinu ya utambulisho na udanganyifu, jukwaa ambalo tulitamani lingekuwepo tulipokuwa tukijenga bidhaa sisi wenyewe: wazi, rahisi, na rafiki kwa watengenezaji, ili lifanye kazi kama sehemu halisi ya stack yako badala ya sanduku jeusi unalounganisha.
API moja inashughulikia kuthibitisha watu (KYC, mjue mteja wako), kuthibitisha biashara (KYB, ijue biashara yako), kuchunguza pochi za crypto (KYT, ijue muamala wako), na kufuatilia miamala kwa wakati halisi, kwenye stack iliyojengwa kuwa:
Msingi wake: aina 14,000+ za nyaraka katika lugha 48+, vyanzo vya data 1,000+, na ishara za udanganyifu 200+ kwenye kila kipindi. Miundombinu ya Didit inajifunza kwa nguvu kutoka kila kipindi na inaboresha kila siku.
Uthibitishaji wa kipengele cha pili kwa kutumia uso wa mtumiaji, sio code iliyotumwa kupitia mtandao. Kipengele cha kwanza ni kile mtumiaji anachokijua (nenosiri, passkey, magic link). Kipengele cha pili ni kile mtumiaji alicho, selfie ya moja kwa moja inayolingana 1:1 dhidi ya picha ambayo mtumiaji alijisajili nayo hapo awali.
Inakaa mahali pale pale kama nenosiri la mara moja la SMS (OTP) katika mtiririko wa programu yako, lakini kwa gharama tofauti, usalama, na wasifu wa ubadilishaji.
Aina nne za mashambulizi zilizoelezwa vizuri huishinda. Shirika la Upelelezi la Shirikisho la Marekani (FBI) na Kituo cha Kitaifa cha Usalama wa Mtandao cha Uingereza (NCSC) vyote vimechapisha mwongozo unaoelekeza mashirika mbali na SMS kwa mifumo nyeti.
Mchakato mzima kwa kawaida huchukua chini ya sekunde 30 kuanzia mwanzo hadi mwisho, chukua kitambulisho, piga picha ya hati, piga selfie, umemaliza. Huu ndio wa haraka zaidi sokoni. Watoa huduma wa zamani wa KYC kwa kawaida huchukua zaidi ya sekunde 90 kwa mchakato huohuo.
Kwa upande wa nyuma, Didit inarudisha matokeo katika chini ya sekunde mbili kwa p99, ikipimwa kuanzia wakati mtumiaji anamaliza selfie hadi wakati webhook yako inawashwa. Ukamataji wa simu umeboreshwa kwa simu za polepole na mitandao ya polepole: ukandamizaji wa picha unaoendelea, upakiaji wa polepole wa software development kit, na uhamishaji wa kugusa mara moja kutoka desktop kwenda simu kupitia QR code ikiwa mtumiaji anaanza kwenye wavuti.
Timu nyingi husajili wakati wa kipindi cha awali cha Know Your Customer (KYC) cha mtumiaji. Picha iliyokamatwa na hatua ya uhai huhifadhiwa ikiwa imeunganishwa na vendor_data yako na kutumika kama template kwa kila uthibitishaji upya unaofuata.
Ikiwa huendeshi KYC wakati wa kujisajili, unaweza kuendesha kipindi cha usajili cha mara moja dhidi ya mtiririko wa kazi wa Didit ambao una LIVENESS + FACE_MATCH pekee. Njia yoyote inagharimu $0.10 mara moja, na template inayotokana inaweza kutumika tena kwa kila uthibitishaji wa baadaye.
Kila kipindi huishia kwenye mojawapo ya hadhi saba zilizo wazi, kwa hivyo code yako daima inajua nini cha kufanya:
Approved, hundi zote zimepita. Mpeleke mtumiaji mbele.Declined, hundi moja au zaidi zimeshindwa. Unaweza kumruhusu mtumiaji kutuma upya hatua maalum iliyoshindwa (kwa mfano, kupiga selfie upya) bila kuendesha mchakato mzima upya.In Review, imewekwa alama kwa ukaguzi wa kufuata sheria. Fungua kesi kwenye console, angalia kila ishara, amua kuidhinisha au kukataa.In Progress, mtumiaji yuko katikati ya mchakato.Not Started, kiungo kimetumwa, mtumiaji bado hajafungua. Tuma ukumbusho ikiwa itakaa muda mrefu.Abandoned, mtumiaji alifungua kiungo lakini hakumaliza kwa wakati. Mshirikishe tena au muda wake uishe.Expired, kiungo cha kipindi kimepitwa na wakati. Unda kipindi kipya.Webhook iliyosainiwa huwashwa kila mabadiliko ya hadhi, kwa hivyo database yako daima inabaki sawa. Vipindi vilivyoachwa na kukataliwa ni bure.
Data ya uzalishaji inachakatwa na kuhifadhiwa katika Umoja wa Ulaya kwa chaguo-msingi, kwenye Amazon Web Services. Mikataba ya biashara inaweza kuomba maeneo mbadala kwa mamlaka ambazo wasimamizi wake wanahitaji.
Usimbaji fiche kila mahali. AES-256 ikiwa imetulia kwenye kila database, hifadhi ya vitu, na backup. Transport Layer Security 1.3 ikiwa safarini kwenye kila API call, webhook, na kipindi cha Business Console. Data ya kibayometriki imesimbwa kwa kutumia Customer Master Key tofauti.
Uhifadhi ni wako kudhibiti. Uhifadhi chaguomsingi ni usio na kikomo (unlimited) isipokuwa ukisanidi muda mfupi, kati ya siku 30 na miaka 10 kwa kila programu, na unaweza kufuta kipindi chochote cha kibinafsi wakati wowote kutoka kwenye dashibodi au API.
Vyeti: SOC 2 Type 1 (ukaguzi wa Type 2 unaendelea), ISO/IEC 27001:2022, iBeta Level 1 PAD, na uthibitisho wa umma kutoka Tesoro / SEPBLAC / CNMV ya Hispania kwamba uthibitishaji wa utambulisho wa mbali wa Didit ni salama zaidi kuliko kumthibitisha mtu ana kwa ana. Ripoti kamili inapatikana kwenye /security-compliance.
Didit inatii sheria kwa chaguo-msingi kwa wasimamizi muhimu kwa miundombinu ya utambulisho:
Memo ya kina, kila cheti, kila barua ya mdhibiti: /security-compliance.
Njia tatu za kuunganisha, chagua inayofaa stack yako:
Dashibodi moja, bili moja, bei sawa ya kulipa-kwa-mafanikio kwa zote tatu. Mwongozo wa hatua kwa hatua kwenye docs.didit.me/integration/integration-prompt.
Ni drop-in kwa mkataba wako uliopo wa one-time-password callback.
POST /v3/session/ na workflow_type: "biometric_authentication" na vendor_data ile ile uliyotumia wakati wa usajili.session_url iliyorudishwa.X-Signature-V2 header kwenye webhook kabla ya kuamini body.status, Approved (tekeleza hatua), Declined (zuia), In Review (weka foleni), Not Finished (omba tena).Timu nyingi hubadilisha SMS kwa uso ndani ya wikiendi. Prompt kamili inayoweza kubandikwa na wakala iko hapo juu; seva ya Model Context Protocol (MCP) inazungumza nyuso zote mbili.
Face Match 1:1 ni imara dhidi ya mabadiliko ya wastani ya sura, nywele za usoni, miwani, rangi ya nywele, mwanga. Alama ya kufanana inayorudishwa kwa kila uthibitishaji inaonyesha jinsi model ilivyo na uhakika.
Kwa watumiaji wanaotoka nje ya kizingiti cha kuidhinisha kiotomatiki (kisa cha kawaida: mabadiliko makubwa ya uzito, upasuaji, kuzeeka kwa miaka mingi), uamuzi unarudi In Review na kuelekezwa kwenye foleni yako ya shughuli. Njia ya kawaida ya kurejesha ni kikao cha kusajili upya, simu moja ya KYC inaburudisha picha, na uthibitishaji unaofuata unatumia template mpya.
Ndio kwa kategoria ya inherence. Viwango vya Kiufundi vya Udhibiti wa Mamlaka ya Benki ya Ulaya kuhusu Uthibitishaji Imara wa Wateja vinatambua sifa za kibayometriki (kitu ulicho nacho) kama sababu halali ya pili inapounganishwa na mojawapo ya kategoria nyingine mbili (maarifa au milki).
Kwa mtiririko kamili wa PSD2 strong-customer-authentication, unganisha biometric 2FA na nenosiri la mtumiaji (maarifa) au kikao kilichofungwa na kifaa (milki). Uamuzi uliosainiwa wa Didit ni ushahidi wa audit-pack wa sababu ya inherence.
API moja kwa KYC, KYB, Ufuatiliaji wa Miamala, na Uchunguzi wa Wallet. Unganisha ndani ya dakika 5.