Age verification

IDfier knows the customer's verified date of birth (from their ID document, BankID or EU Digital Identity Wallet) and sends you only the answer:

{ "id": "u_3f9a…", "ageOver18": true }

Age verification isn't a separate API. It is a set of age scopes that you use with either way of verifying a customer:

Age scopesCopy Anchor Link

• Only the five ageOver limits above exist. Any other number, such as ageOver20, is not an age check: verification links reject it, and the login API ignores it. Use ageBetween20And130 for another limit.
• ageBetween18And25 is true from the 18th birthday until the day before the 26th. min must be lower than max.
• If IDfier has no date of birth for the customer, the field is left out. Treat a missing field the same as false: not verified.
• You get only the answer. The date of birth and the age are sent only if your business client also has the dateOfBirth or age scope, so ask for the answer alone if that's all you need.

The answer is computed when you read the result, so it is correct on the day you ask.

With Login with IDfierCopy Anchor Link

A login session's scopes come from your business client, so ask IDfier to set up a client for age checks, for example with the scopes ageOver18 and authLevel. Then follow the login flow and read the answer from the result:

{
  "status": 100,
  "data": {
    "user": { "id": "u_3f9a…", "ageOver18": true, "authLevel": "Gold" },
    "session": {
      "referenceId": "550e8400-e29b-41d4-a716-446655440000",
      "status": "approved",
      "method": "idfier",
      "expiresAt": "2026-10-31T10:05:00.000Z",
      "createdAt": "2026-10-31T10:00:00.000Z"
    }
  }
}

Grant access only when user.ageOver18 === true. Read the result on your server and keep the decision there: never trust an answer sent back from the customer's browser.

Different checks for different products, say 18 for one and 21 for another? Ask IDfier for a business client per check, or use verification links, where you choose the check per link.

With verification linksCopy Anchor Link

Choose the check when you create the link. Your business client needs at least one of the scopes age, dateOfBirth or an age scope; then any age check is allowed:

curl -X POST https://api.idfier.com/api/v3/business/links \
  -H "clientid: $IDFIER_CLIENT_ID" \
  -H "clientsecret: $IDFIER_CLIENT_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "recipientName": "Anna Lindqvist",
    "recipientEmail": "anna@example.com",
    "message": "Please confirm your age before we hand over the keys.",
    "scopes": ["ageOver18"],
    "expiresInDays": 3
  }'

Then poll GET /business/links/:id until status is approved:

{
  "status": 100,
  "data": {
    "id": "…",
    "status": "approved",
    "scopes": ["ageOver18"],
    "method": "idfier",
    "result": { "id": "u_3f9a…", "ageOver18": true }
  }
}

Each link uses one verification credit; with none left you get 402.

What the customer seesCopy Anchor Link

The IDfier app shows your business name and logo and what you're asking for before the customer approves. They can decline; the session or link is then denied.

Which authLevel to trustCopy Anchor Link

Add the authLevel scope to know how the customer's identity, and so their date of birth, was verified:

For goods with a legal age limit you may want to require Gold, EU Wallet or Silver.