Live ID Validation

Add biometric logon to your app — confirm a returning user by matching a live selfie against their already-verified Certivant KYC face, and gate access on a simple matched true/false.

Live ID Validation turns a customer's already-verified KYC identity into a biometric logon factor. At login time the user takes a live selfie; Certivant matches it against their verified KYC face (the same face-match + liveness pipeline used during onboarding) and returns a simple matched: true | false you gate access on.

Live ID Validation (this feature) re-authenticates a returning user. It is different from the live Verification video conference (a human-assisted onboarding call). Different feature, different name.

How it works

graph LR
  A[User starts login] --> B[Your backend mints a session]
  B -->|holds the Identification Key| C[Certivant verifies key, returns sessionToken + captureUrl]
  C --> D[Device opens captureUrl in a WebView]
  D --> E[Selfie -> face match + liveness]
  E --> F[Your backend reads matched]
  F -->|matched true| G[Grant login]
  F -->|matched false| H[Deny / fall back]

The encrypted Identification Key is your long-lived, per-profile credential. It stays on your backend — the device only ever holds a single-use, short-lived session token (default TTL 120s). The key is sealed with AES-256-GCM and an Ed25519 signature, so any single-bit tampering is rejected server-side; the session token can do nothing but submit one selfie for one profile.

Prerequisites

A verified, enrolled profile. A KYC applicant becomes eligible for Live ID once their request is APPROVED and Live ID is enabled for your tenant. Enrollment is automatic at approval — it captures the verified selfie as the reference face.

Live ID enabled + thresholds. Turn it on at KYC → Settings → Live ID (liveIdEnabled), where you also set the minimum face-match score, whether liveness is required, and the session TTL.

A plan with Live ID capacity. Your plan's Live ID Validations / month included quota covers free validations; beyond that, each one bills Price per Live ID Validation (PAYG) to your wallet. See Billing.

An Identification Key per profile. Issue one at KYC → Live ID → Keys (or via the keys API) against an enrolled profile. Store it on your backend, keyed to your user.

Integrate in four steps

Mint a session — server-side. When a user begins login, your backend posts the user's Identification Key to Certivant and gets back a sessionToken + a captureUrl.

curl -X POST https://app.certivant.com/api/kyc/public/live-id/sessions \
  -H "Content-Type: application/json" \
  -d '{"key":"livid_…"}'
# → { "sessionToken": "…", "captureUrl": "https://…/live-id/…", "expiresAt": "…" }

Open the capture page. Send the device to captureUrl — a hosted, mobile-first page that handles the camera, selfie, and result UI. On the web, open it in a popup or redirect; in a mobile app, load it in a WebView (see Mobile onboarding).

Read the result. Either subscribe to the live_id.validation.completed webhook (recommended), or poll GET /api/kyc/public/live-id/sessions/:sessionToken until status is completed and read matched.

Gate login. matched === true → grant access. false → deny or fall back to another factor. Each completed validation is metered (and billed if over quota).

See the full request/response shapes in the API reference.

Why the key never touches the device

Putting the Identification Key in client code would let anyone who extracts it mint sessions for any of your users. Instead:

The key lives on your backend and is used only in the server-to-server POST /sessions call.
The session token the device receives is single-use, short-lived, and bound to exactly one enrolled profile. Submitting a selfie is all it can do.
A tampered key is rejected before any work happens (two independent integrity gates: GCM auth tag + Ed25519 signature).

Billing

Live ID is quota-aware:

Validations within your plan's monthly included quota are free (but metered).
Beyond the quota, each validation bills Price per Live ID Validation to your dollar wallet.
If the next validation would be PAYG and your wallet can't cover it, POST /sessions returns 402 verification_unavailable — the flow fails fast, before the user opens the camera, so you can top up or fall back.

Trialing organizations use the plan's Trial Live ID Validations / month quota. Usage appears on your monthly KYC usage record.

API reference — mint, capture, poll, validate, and the webhook payload.
Mobile onboarding — WebView embedding + sample apps for iOS, Android, and .NET MAUI.