Face checks

IDfier compares a photo with the photo on the customer's ID document and sends you the answer, a yes or no plus a score:

{ "id": "u_3f9a…", "photoMatch": true, "photoMatchScore": 94 }

You never receive the ID document photo. The comparison runs at IDfier, and the customer approves every check in the IDfier app.

There are two face check scopes. IDfier enables them on request, like personalNo:

The fieldsCopy Anchor Link

• photoMatch and profilePictureMatch are true from a score of 80. Use the score if you need a stricter or looser threshold.
• A check is left out when it isn't possible: the customer verified without an ID document (e.g. BankID), shared from an EU Digital Identity Wallet, or has no profile picture. Treat a missing field as not verified.
• The scores are computed when the customer approves, so they are in the result as soon as the session is approved.

Check a photo (photoMatch)Copy Anchor Link

Send the photo with the login request, as a base64-encoded JPEG or PNG of at most 3 MB (a data:image/jpeg;base64, prefix is fine):

curl -X POST https://api.idfier.com/api/v3/business/auth/request \
  -H "clientid: $IDFIER_CLIENT_ID" \
  -H "clientsecret: $IDFIER_CLIENT_SECRET" \
  -H "Content-Type: application/json" \
  -d "{\"photo\": \"$(base64 -i photo.jpg)\"}"

Then follow the login flow as usual: show the QR code, wait for the customer to approve, and read the result:

{
  "status": 100,
  "data": {
    "user": {
      "id": "u_3f9a…",
      "fullname": "Anna Lindqvist",
      "photoMatch": true,
      "photoMatchScore": 94
    },
    "session": {
      "referenceId": "550e8400-e29b-41d4-a716-446655440000",
      "status": "approved",
      "method": "idfier",
      "expiresAt": "2026-11-05T10:05:00.000Z",
      "createdAt": "2026-11-05T10:00:00.000Z"
    }
  }
}

• The check is only part of sessions that carry a photo. A login request without photo works as before and doesn't mention a photo to the customer.
• Your photo is stored encrypted only until the customer answers (at most the session's 5 minutes) and then deleted, whatever the outcome.
• Send a clear, front-facing photo of one person. With no face in it the score is 0.
• photoMatch works with login requests only, not with verification links: a link has no photo to check.

Receive the profile picture (profilePicture)Copy Anchor Link

With the profilePicture scope, every approved login (and every verification link that asks for it) includes the picture from the customer's default IDfier profile:

{
  "id": "u_3f9a…",
  "profilePicture": "https://…public.blob.vercel-storage.com/avatars/…/anna.jpg",
  "profilePictureMatch": true,
  "profilePictureMatchScore": 91
}

• IDfier checks the picture against the ID document photo when the customer approves, so profilePictureMatch tells you whether it really shows them.
• If the customer has no profile picture, all three fields are left out.
• The URL is public and stable. Copy the image to your own storage if you keep it; the customer may change their picture later.

What the customer seesCopy Anchor Link

The IDfier app shows your business name and logo and what you're asking for before the customer approves, for example "Acme wants to check that a photo is you" or "Acme will receive your profile picture". They can decline; the session is then denied.

Face checks need a recent version of the IDfier app. Customers on an older version are asked to update it before they can approve.

ErrorsCopy Anchor Link

POST /business/auth/request answers 400 when the photo can't be used: