NEW Verification Sessions API: push and QR from one call →

Prove who you are.
Share only what's needed.

FotoID.me turns your iPhone into a verified identity. It is checked against your driver's license and matched to your face on the device. When a site needs to know who you are, you choose exactly what to share, and only they can read it.

Try the live demo Read the integration guide

Face matching on-device
End-to-end encrypted answers
No identity data on our servers

POST /api/VerificationSession

201pushStatus: "sent"

9:41●●●

Acme Bank

wants to verify your identity

✓ Live photo verified

Choose what to share

First name
Alex
Last name
Morgan
Date of birth
04/15/1991
Street address
1200 Congress Ave
City
Austin

🔒 Encrypted for Acme only. FotoID can't read it.

Approve & share

decrypted by Acme

✓challenge matches

✓livePhotoVerified: true

identity fields stored on FotoID servers

1 call

starts a session with both push and QR

RSA-2048

+ AES-256-GCM, sealed for your key only

100%

of face matching happens on the phone

How it works

Verify once. Reuse everywhere. Stay in control.

Your identity is set up once on your phone. After that, every request is a tap and a glance, and nothing leaves the phone unless you approve it.

Register once

Scan your driver's license. The app reads it with on-device OCR and builds a face template from your photo. Both are stored in the iPhone Keychain.
A site asks

A bank, store or app requests specific details. You get a push notification, or you scan a QR code at the counter or on screen.
You decide

Unlock with Face ID, take a live selfie if they asked for one, and untick anything you'd rather keep. Nothing is approved automatically.
Sealed for them

Your answer is encrypted with the requester's public key on your phone. Only they can open it, and FotoID can't.

Privacy by architecture

We built FotoID so we can't see your identity.

This isn't a policy promise. The system is designed so FotoID never holds your identity data. Here is what each party holds and what it never holds.

Holds your identity

📱 Your iPhone

✓Profile, in the Keychain
✓License photo, sandboxed
✓512-d face template
✕Never uploads biometrics

Routes requests only

🛰 FotoID backend

✓Email (encrypted + keyed hash)
✓Push token (encrypted)
✕No names, dates of birth, addresses or IDs
✕No verification history
✕Can't decrypt responses

Receives what you approve

🏦 The requester

✓Only the fields you ticked
✓Decrypts with its own private key
✓Checks its challenge (anti-replay)

End-to-end encrypted

Hybrid RSA-OAEP + AES-256-GCM with a fresh key for every answer. If a requester's key is invalid, nothing is sent.

On-device biometrics

Apple Vision and Core ML compare a live selfie to your license photo. No face image or template is ever sent.

Per-field consent

You see exactly what is requested and can untick any field. Declining sends nothing.

Short-lived by design

Sessions expire in minutes. An answer is wiped as soon as the requester collects it, or after 10 minutes at the latest.

Live integration demo

See a real integration, end to end

On the left is Acme Bank, a fictional site that integrates "Verify with FotoID.me". On the right is the FotoID app. The encryption is real and runs in your browser. Nothing is sent anywhere.

acme.example/open-account

Acme Bank
Demo integration

Open your account in minutes

Skip the forms and the document uploads. Share your verified identity from the FotoID.me app.

Your FotoID email (optional)

With an email, the user's phone gets a push. Clear it for a QR-only session.

Acme will request

9:41●●●

Event log: API calls as they happen

Start a verification to watch the calls.

Want to run it against the real API? The repo includes FotoID.Demo.Web, the same Acme Bank and phone simulator connected to api.fotoid.me.

Use cases

One integration. Every moment you need to know who's there.

Each request asks only for the fields it needs. Live-photo checks are on when the stakes call for them and off when they don't.

Banking & fintech onboarding

Pre-fill applications with ID-verified details and a live selfie match, without asking for document uploads.

firstNamelastNamedateOfBirthstreet1livePhoto

Age-restricted sales

Confirm someone is 21+ from their date of birth alone. You never see their name or address.

dateOfBirthlivePhoto

Passwordless sign-in

Users type their email and approve on their phone. A push notification replaces the password.

emailAddressfirstName

Rentals & the sharing economy

Check who's picking up the car or the keys. The live photo proves the license holder is the one holding the phone.

firstNamelastNamelicenseNumberlivePhoto

Patient & client check-in

Show a QR code at the front desk. Patients scan, approve and walk in, with no clipboard or photocopied ID.

firstNamelastNamedateOfBirthcellPhone

In-person & events

The QR flow works when your venue has no internet connection. The phone only needs a network to deliver the sealed answer.

firstNamelastNamecurrentLocation

For developers

Add "Verify with FotoID.me" in an afternoon

Create a session, show the QR, then collect the answer by polling or webhook. Decrypt it with your own key. That's the whole integration.

One endpoint for both push and QR delivery
You own the keys: RSA-2048+ public key per request
Built-in replay protection with a per-session challenge
HMAC-signed webhooks, or plain polling
Email-targeted sessions: only that account can answer

Integration guide → Watch it run

curl https://api.fotoid.me/api/VerificationSession \
  -H "Authorization: Bearer fid_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]",
    "requiredFields": ["firstName","lastName","dateOfBirth"],
    "livePhotoRequired": true,
    "encryptionKeys": {
      "publicKey": "-----BEGIN PUBLIC KEY-----\n...",
      "keyId": "key-001",
      "algorithm": "RSA-2048"
    },
    "callbackUrl": "https://you.example/webhooks/fotoid",
    "expiresInSeconds": 300
  }'

# → { "content": { "sessionId": "…", "challenge": "…",
#      "qrCodeSvg": "<svg…", "pushStatus": "sent" } }

import crypto from 'node:crypto';

export function decryptFotoID(p, privateKeyPem) {
  const aesKey = crypto.privateDecrypt(
    { key: privateKeyPem, oaepHash: 'sha256',
      padding: crypto.constants.RSA_PKCS1_OAEP_PADDING },
    Buffer.from(p.encryptedKey, 'base64'));

  const d = crypto.createDecipheriv('aes-256-gcm', aesKey,
    Buffer.from(p.iv, 'base64'));
  d.setAuthTag(Buffer.from(p.tag, 'base64'));
  const json = Buffer.concat([
    d.update(Buffer.from(p.ciphertext, 'base64')), d.final()]);
  return JSON.parse(json.toString('utf8'));
}

// Always check: result.challenge === session.challenge

using System.Security.Cryptography;
using System.Text.Json.Nodes;

static JsonNode DecryptFotoID(JsonNode p, RSA privateKey)
{
    var aesKey = privateKey.Decrypt(
        Convert.FromBase64String((string)p["encryptedKey"]),
        RSAEncryptionPadding.OaepSHA256);

    var cipher = Convert.FromBase64String((string)p["ciphertext"]);
    var plain  = new byte[cipher.Length];
    using var gcm = new AesGcm(aesKey, 16);
    gcm.Decrypt(Convert.FromBase64String((string)p["iv"]), cipher,
                Convert.FromBase64String((string)p["tag"]), plain);

    return JsonNode.Parse(plain);
}
// Always check: result["challenge"] == session.Challenge

Why FotoID

Less data to hold. Less risk to carry.

	Upload-your-ID verification	FotoID.me
What you receive	Photos of the whole document, plus selfies	Only the fields you asked for and the user approved
Biometric processing	Usually on a vendor's servers	On the user's phone, never transmitted
Who can read the result	You, your vendor and their subprocessors	Only you, because it's sealed with your public key
Repeat visits	Upload again, or fall back to a password	One push and one tap
Replay protection	Varies	A per-session challenge is echoed inside the ciphertext
In person	Staff look at a plastic card	Scan a QR and receive verified, structured data

FAQ

Questions, answered

Can FotoID see what I share?

No. Your phone encrypts each answer with the requester's own RSA public key before it leaves the device. FotoID relays or stores only that ciphertext, for a few minutes at most, and doesn't hold the private key needed to open it. Our servers store your email and your phone's push token, both encrypted, and nothing else about you.

What does a "live photo" check actually prove?

When a requester sets livePhotoRequired, the app takes a live selfie and compares it on-device against the photo on your driver's license using a Core ML face model. The match must pass a similarity threshold, with three attempts at most. The requester learns only the result and a confidence label, never the image.

Which phones are supported?

The FotoID.me app runs on iPhone with iOS 15 or later. The backend API is platform-neutral, and Android support is on the roadmap.

What if I don't want to share a field?

Untick it. Every requested field has its own checkbox, and the requester receives only what you leave ticked. You can also decline the whole request, and then nothing is sent.

How does a website know the answer isn't replayed or forged?

Every session carries a random challenge. The phone puts it inside the encrypted answer, and the requester checks that it matches before trusting anything. AES-GCM authentication rejects any tampering, and webhooks are HMAC-signed with a timestamp.

Does it work without internet?

Registration and unlocking work fully offline. In the QR flow, the scan and approval happen on the phone, which needs a connection only to deliver the sealed answer. Push requests need a network.

How do we get API access?

Contact us and we'll set up your organization as a requester. You'll get an API key (fid_live_…) and, optionally, a webhook signing secret. Then follow the integration guide.

Verify people without becoming a vault

Get API credentials for your organization and go live with push and QR verification, end-to-end encrypted from day one.

Request API access Read the docs

Prove who you are.Share only what's needed.

Verify once. Reuse everywhere. Stay in control.

Register once

A site asks

You decide

Sealed for them

We built FotoID so we can't see your identity.

📱 Your iPhone

🛰 FotoID backend

🏦 The requester

End-to-end encrypted

On-device biometrics

Per-field consent

Short-lived by design

See a real integration, end to end

Open your account in minutes

Check your phone

One integration. Every moment you need to know who's there.

Banking & fintech onboarding

Age-restricted sales

Passwordless sign-in

Rentals & the sharing economy

Patient & client check-in

In-person & events

Add "Verify with FotoID.me" in an afternoon

Less data to hold. Less risk to carry.

Questions, answered

Verify people without becoming a vault

Prove who you are.
Share only what's needed.