Identity verification API · Early access
Document, selfie and live movement checks in one web link. Every result comes back approved, rejected or sent to review, with reason codes your rules and your auditors can read.
Example verification: a person completes three live movements, the document is read and checked by check digits, and the API returns an approved decision with its checks and reasons.
Built on rules you can check
The problem
Most verification tools return a score with no reason attached, a price you only learn after a sales call, and a reading of the document that nobody double-checks.
Fraud in Brazil
10.9M
fraud attempts in Brazil from January to September 2025, one every 2.2 seconds
33%
of those attempts were caught by document authenticity and biometric checks
51%
of Brazilian adults were victims of some kind of fraud in 2024
The cost of verifying
$2.45 to $7.45
real cost per check at 20 verifications a month, once monthly minimums are counted
Source: Our calculation on the published self-serve plans of three IDV providers, Oct 2026
~1.5x
more paid when billing is per attempt instead of per completed check, at 35% drop-off
"0.71" does not tell your analyst what to do, and it does not tell your auditor why you approved.
Vision models fill an unreadable digit with a plausible one. If nothing recomputes it, a wrong CPF looks exactly like a right one.
Local leaders quote after a demo. Global players bill in dollars with a monthly minimum. Small volumes pay the most per check.
How it works
You create a session, send the link through your own channel and read a decision you can act on. About two minutes for the person verifying.
# Request
POST /v1/sessions
Authorization: Bearer idv_test_8f2a.••••••••
X-Request-Id: signup-48213
{ "external_reference": "customer-48213",
"expected": { "name": "Maria A. Souza", "cpf": "111.444.777-35" } }
# Response 201
{ "id": "7f3c1e9a-2b4d-4c8e-9a51-0d6b3f2e8c17",
"status": "pending",
"capture_url": "https://ipsis.tolky.to/c/#k3Xq…",
"expires_at": "2026-10-30T14:02:11Z" }AAcme
Hi! Acme Lending asked to verify your identity
I agree to the use of my biometric data for this verification
Continue on your phone: scan the QR code
Continue on this computerAre these details correct?
{ "status": "awaiting_review",
"checks": [
{ "id": "cpf_valid", "status": "pass" },
{ "id": "cpf_matches_expected", "status": "pass" },
{ "id": "name_matches_expected", "status": "warn",
"reason": "name_mismatch_expected" },
{ "id": "liveness_challenges", "status": "pass" },
{ "id": "face_match", "status": "pass" }
],
"decision": { "status": "awaiting_review",
"reasons": ["manual_review_mode", "name_mismatch_expected"] } }The person only sees the outcome, never the reasons. Reasons are for you.
Checks
Each one returns pass, warn or fail with a stable reason code. Any fail rejects. Any warn sends the session to review. Nothing missing is ever treated as a pass.
Nothing the reading finds is accepted before a rule confirms it.
document_typeThe images match the document the person chose.
required_fieldsName and document number were read.
cpf_validThe CPF is recomputed digit by digit. A misread digit fails here.
cpf_matches_expectedThe CPF on the document matches the one you sent.
name_matches_expectedWord-by-word comparison that ignores accents and connectors. Raises a warning, never rejects.
birth_dateThe date is read, valid on the calendar, and the holder is 18 or older.
birth_matches_expectedSame date you already hold.
not_expiredExpiry is checked on CNH, CIN and passport. A CNH up to 30 days past expiry goes to review.
cnh_number_validThe 11-digit CNH registration is recomputed.
mrz_validPassport and CIN machine-readable lines are checked digit by digit and against the printed data.
customer_confirmedIf the person flags the data we read as wrong, the session goes to review.
Movements drawn at random and confirmed on the server.
liveness_challengesThree movements drawn at random (turn left, turn right, smile, blink), always with a head turn, confirmed on the server.
capture_integrityFrames must arrive per movement, inside a time window set by the server, with continuity between them.
face_matchThe selfie is compared with the document photo against thresholds you set. In between: review.
When in doubt, a person decides.
engine_unavailableIf the face engine is down or busy, the session goes to review. It is never approved for lack of capacity.
decision_mode: manualNothing is approved automatically until you turn auto mode on. Clear failures still reject on their own.
Developers
Create a session, send the link, read the result. Reason and error codes are part of the contract: changing one is a breaking change.
curl https://ipsis.tolky.to/v1/sessions \
-H "Authorization: Bearer idv_test_8f2a.••••••••" \
-H "X-Request-Id: signup-48213" \
-H "Content-Type: application/json" \
-d '{
"external_reference": "customer-48213",
"expected": {
"name": "Maria A. Souza",
"cpf": "111.444.777-35",
"birth_date": "1991-03-14"
},
"allowed_documents": ["cnh", "cin", "rg", "passport"],
"redirect_url": "https://acme.example/onboarding/done",
"locale": "pt-BR"
}'{
"id": "7f3c1e9a-2b4d-4c8e-9a51-0d6b3f2e8c17",
"status": "pending",
"capture_url": "https://ipsis.tolky.to/c/#k3Xq…",
"expires_at": "2026-10-30T14:02:11Z"
}curl https://ipsis.tolky.to/v1/sessions/7f3c1e9a-2b4d-4c8e-9a51-0d6b3f2e8c17 \
-H "Authorization: Bearer idv_test_8f2a.••••••••"{
"id": "7f3c1e9a-2b4d-4c8e-9a51-0d6b3f2e8c17",
"status": "awaiting_review",
"external_reference": "customer-48213",
"document_type": "cnh",
"checks": [
{ "id": "cpf_valid", "status": "pass", "reason": "ok" },
{ "id": "cpf_matches_expected", "status": "pass", "reason": "ok" },
{ "id": "name_matches_expected", "status": "warn", "reason": "name_mismatch_expected" },
{ "id": "liveness_challenges", "status": "pass", "reason": "ok" },
{ "id": "face_match", "status": "pass", "reason": "ok" }
],
"decision": {
"status": "awaiting_review",
"by": "system",
"reasons": ["manual_review_mode", "name_mismatch_expected"]
},
"attempt": 1
}curl https://ipsis.tolky.to/v1/match \
-H "Authorization: Bearer idv_test_8f2a.••••••••" \
-F selfie=@selfie.jpg \
-F reference=@reference.jpg// illustrative
{
"decision": "match", // match | no_match | inconclusive
"request_id": "9b2e41d0-…"
}Illustrative example, trimmed for reading.
Prefixes tell them apart. A test key never works in production. Server to server only.
Send X-Request-Id. A retry with the same id is never billed twice.
quota_exceeded, engine_busy with Retry-After, session_expired and more. Build on code, not on the message.
POST /review to approve or reject a session in review. DELETE /data to erase its images and personal data.
GET /v1/usage returns billable totals, your quota and what is left this month.
Get notified when a session completes, with an HMAC signature. Until then, poll GET /v1/sessions/:id.
Security and privacy
Biometrics are sensitive personal data under Brazil's LGPD (art. 11) and a special category under the GDPR (art. 9). Here is what we do with them, and what we don't do yet.
You are the controller. We process on your behalf.
Every image is encrypted by the application with AES-256-GCM before it reaches storage. The bucket only holds ciphertext.
Storage is private. Images leave only through an authenticated API route, never through a public or pre-signed URL.
The numeric representation of a face exists only in memory during comparison. We store scores, never templates.
One call erases a session's images and personal data. It is idempotent and leaves an audit event.
Retention is configurable per customer, down to zero days (images deleted as soon as the session is decided). A daily job enforces it.
Every query is scoped to your account. Another customer's resource answers "not found".
Before any capture, the person accepts a specific consent for biometric data that names your company as controller. Logged with IP and user agent.
The capture token travels after the # of the URL, which browsers never send to servers.
Document reading uses an external vision provider. It is named in your contract as a sub-processor, with the countries involved.
No certifications yet. This is the list of what is missing and where each item stands. We update it when something changes.
Who it's for
Companies that let strangers in at scale and need to explain each decision later.
Lenders, payment companies and digital accounts.
Typical uses
Delivery, mobility, rentals and services that onboard sellers and providers by the thousand.
Typical uses
Operators licensed in Brazil.
Typical uses
Supports compliance; it does not replace your own assessment. We do not query government databases.
Talk to usAlso used for
Pricing
Public prices, no setup fee and a plan with no monthly minimum. You are billed once, when a session reaches its first result.
Early access: prices are published for planning and may change before general availability.
Try it with real cases
$0
25 verifications per month
No card required
Includes:
Pay as you go, no monthly minimum
$0.59
per verification
Prepaid credits from $20
Everything in Free, plus:
Recommended
For recurring onboarding
$225/month
$2,250/year
500 verifications included per month
6,000 verifications included per year
Then $0.45 per verification
Everything in Starter, plus:
High volume and regulated sectors
$975/month
$9,750/year
2,500 verifications included per month
30,000 verifications included per year
Then $0.39 per verification
Everything in Growth, plus:
Contract, custom terms and volume. From 10,000 verifications per month.
Custom
Talk to usPrices in US dollars. Companies registered in Brazil (CNPJ) are billed in BRL; all others in USD, regardless of the site language.Pay 10 monthly minimums upfront and get 12 months. Included verifications become a yearly balance. Overage keeps the plan price.
A session that reaches a result: approved, rejected or awaiting review.
Set a monthly cap. Above it, new sessions are refused with quota_exceeded, never billed.
X-Request-IdIncluded in every plan
| Feature | Free | Starter | Growth | Scale | Enterprise |
|---|---|---|---|---|---|
| Price per verification | $0 | $0.59 | $0.45 | $0.39 | Custom |
| Monthly minimum | Not included | Not included | $225 | $975 | Contract |
| Included verifications per month | 25 | 25 | 500 | 2,500 | Contract |
| Overage | Not included | Pay as you go | $0.45 | $0.39 | Contract |
| 1:1 face match | 100 per month | $0.05 | $0.05 | $0.05 | Contract |
| Annual billing (2 months free) | Not included | Not included | Included | Included | Contract |
| Hosted capture page (en, pt-BR, es) | Included | Included | Included | Included | Included |
| RG, CIN, CNH and passport with check-digit validation | Included | Included | Included | Included | Included |
| Liveness with 3 random movements | Included | Included | Included | Included | Included |
| Selfie x document (1:1) | Included | Included | Included | Included | Included |
| Compare with data you already have | Included | Included | Included | Included | Included |
| Human review by default, optional automatic approval | Included | Included | Included | Included | Included |
| Audit trail | Included | Included | Included | Included | Included |
| Encrypted images, no face template stored, deletion by API | Included | Included | Included | Included | Included |
| Separate test and live keys, idempotent requests | Included | Included | Included | Included | Included |
| Maximum image retention | 7 days | 30 days | 90 days | 365 days | Up to 5 years |
| Thresholds tuned to your case | Not included | Not included | Included | Included | Included |
| Result webhook | Not included | Soon | Soon | Soon | Soon |
| Dashboard | Soon | Soon | Soon | Soon | Soon |
| Document reading with data in Brazil | Not included | Not included | Not included | Soon | Soon |
| Official database check (Brazil, add-on) | Not included | Not included | Soon | Soon | Soon |
| Third-party certified liveness (add-on) | Not included | Not included | Soon | Soon | Soon |
| Support | Docs and email | Email, 2 business days | Priority email, 1 business day | Named contact, 4 business hours | Named contact, in contract |
| Availability SLA | Not included | Not included | Not included | Not included | Soon |
Swipe sideways to see every plan.
Free plan conditions
During early access, we set up your account with you: thresholds, documents and retention.
FAQ
Didn't find your question?
Tell us about your flow and we will answer with what the API does today.
Talk to usA session that reaches its first result: approved, rejected or awaiting review. Unopened links, retries in the same session and repeated requests with the same X-Request-Id are free.
About two minutes for the person verifying, from consent to result. Document reading can take up to 30 seconds. We will publish response times once we have measured them in production.
Brazil's RG, CIN (the new national ID) and physical CNH, front and back, plus the passport data page. You choose which ones each session accepts.
No. The link opens in the phone's browser in English, Spanish or Portuguese. On a computer, a QR code moves them to their phone, or they can continue with a webcam.
We never store face templates. Images are kept encrypted for the retention period configured for your account, and you can delete any session's data by API.
Compliance depends on how you use it, so we don't claim it. We provide the mechanisms: specific consent for biometric data, deletion on request and configurable retention. You are the controller; we process on your behalf under a data processing agreement.
Document reading uses an external vision provider, named in your contract as a sub-processor along with the countries involved. An option to read documents inside Brazil is on our roadmap.
We have not published a rate, because we will only do it with a stated method and sample. Until then, you set the approval thresholds and human review is the default.
Three movements drawn at random and timed by our server are designed to reject printed photos, screens and pre-recorded video. A virtual camera feeding a live deepfake cannot be reliably detected from a browser, so for high-risk flows keep human review on.
No. We recompute the CPF check digits and compare it with the CPF you already hold. We do not confirm with the tax authority who owns it.
Not yet. Today you poll the session endpoint; signed webhooks are on the roadmap. There is no native SDK: the capture is a web page, so there is nothing to embed.
Not yet. Our security section lists what is in place (encryption, isolation, audit trail) and a roadmap with the status of each item that is still missing.
We are opening access to a small group of companies. Tell us about your flow and we will set up your test keys with you.