Face Verification Flow

Current Flow Version - v1.2

Available Since - 1 Mar 2026

Overview

Face Verification is a comprehensive biometric security layer engineered to deliver rigorous identity assurance without compromising on a seamless user experience. By consolidating two critical technologies Passive Liveness Detection and 1:1 Face Matching into a single, synchronized workflow, this solution provides absolute confidence in user authentication. In one swift motion, the system guarantees that the individual interacting with your digital service is not only the legitimate owner of the registered profile (Matching) but is also a real human physically present at that exact moment. This unified approach effectively neutralizes both identity fraud and sophisticated presentation attacks in real-time.

Common Use Cases

New Device Authorization
To protect users against Account Takeover (ATO) fraud, Face Verification can be triggered whenever an existing account is accessed from a new or unrecognized device. Even if an attacker compromises a user's password or intercepts an SMS OTP, they cannot bypass the biometric gate. The synchronized liveness and matching check ensures that only the genuine account holder can authorize and bind a new device.
Automated Account Recovery (Reset PIN/Password)
Handling "Forgot PIN" or locked account requests typically requires expensive, manual customer service verification. Integrating Face Verification allows platforms to fully automate the account recovery lifecycle. Users can securely reset their credentials in seconds by proving their live physical presence and matching it against their onboarding baseline, eliminating manual back-office overhead while maintaining top-tier security.

High Level Flow

sequenceDiagram
    autonumber
    title High Level SDK Flow Overview

    participant PFE as Partner FE
    participant PBE as Partner Backend Service
    participant DIS as Digital Identity SDK
    
    box rgb(240, 240, 240) IAB Infra
        participant TG as Token Gateway
        participant IBE as IAB Gateway
    end

    rect rgb(230, 245, 255)
        Note over PFE, TG: Get Partner token
        PBE->>TG: Get Partner token (client_id, passkey)
        TG-->>PBE: Partner token
        Note over PBE: Cache Partner token
    end

    PFE->>DIS: Initialize Digital Identity SDK

    rect rgb(230, 245, 255)
        Note over PFE, IBE: Get User token
        PFE->>PBE: Call initiate flow API
        PBE->>IBE: Initiate Flow (partner token, user_details)
        IBE-->>PBE: User token
        PBE->>PFE: User token
    end

    rect rgb(235, 230, 255)
        Note over PFE, IBE: Capture image and Submission processing
        PFE->>DIS: launchSelfieVerification(user token, correlationId, baseUrl)
        Note over DIS: Capture Image Screens
        
        rect rgb(255, 245, 230)
            Note over DIS, IBE: Submission Processing
            DIS->>IBE: Start Submission Processing
            Note over IBE: Submission Processing
            IBE-->>PBE: Get Reference Image (User Details)
            PBE-->>IBE: Reference Image (URL)
            Note over DIS: Status Polling
            DIS->>DIS: Do next action:<br/>- RETRY<br/>- STATUS<br/>- EXIT
        end

        DIS->>PFE: on Completion(success/failure)
    end

    rect rgb(230, 245, 255)
        Note over PFE, IBE: Get Result Details
        IBE->>PBE: Submission Processing Compete Callback
        PFE->>PBE: Call "Get Submission Details" API <br/>(correlationId aka partner session id)
        PBE->>IBE: Call "Get Submission Details" API (correlationId, partner token)
        IBE-->>PBE: return submission details
        PBE-->>PFE: Continue processing
    end

    Note over PFE: Show/process result

Detailed Steps:

Partner BE call "Get Partner Token API" through IAB Gateway and caches the Partner Token to be used repeatedly.
Partner FE calls Partner BE to get User Token. Partner BE calls IAB Gateway to get user Token using the Initiate Flow API.
Partner User Id
Partner User Id Type
Onboarding partner tied to the flow, which partner wants to launch.
Partner FE initializes the Digital Identity FE SDK (IAB FE):

Use the initialise method to initialize the SDK.

Partner FE calls launchSelfieVerification() method of Digital Identity SDK to launch Selfie Verification flow with the following parameters:
baseURL: This is the server URL specific to the partner using the format https\://<domain>.
Example: https://onekyc.ky.id.sandbox.gopayapi.com
correlationId: A unique ID used to create a Selfie Verification request and track the specific instance of the Selfie Verification request helpful for logging and event tracking.
token: The unique user token, different for each user.
theme(optional): The theme parameter is optional, and its default value is null. If not provided, the SDK uses the default theme (DefaultOneKycSelfieVerificationFlowTheme).
The theme parameter is an instance of the OneKycSelfieVerificationFlowTheme class. It allows you to customize the look and feel of the Selfie Verification flow screen. By providing a custom theme, you can modify various UI elements, such as colors, fonts, and styles, to match your application's branding requirements.
IAB FE will capture users' selfies and will upload it to IAB Gateway for Face verification processing.
IAB Gateway initiates Face verification processing.
Partner needs to expose an API, which IAB BE will call to get the reference Image. The selfie captured by IAB FE will be compared against this reference image. This reference image can be either selfie or ktp based on the flow which the partner launched.

    sequenceDiagram
    autonumber
    actor User    
    participant PWA as Partner Web App
    participant PBE as Partner Backend

    box rgb(240, 240, 240) IAB
        participant WA as IAB Web App<br>(Mobile/Tablet/Desktop)
        participant WA_Mobile as IAB Web App<br>(Mobile)
        participant BE as IAB Backend
    end

    rect rgb(230, 245, 255)
        Note over PWA, BE: Initialization
        PWA->>PBE: Get launch URL
        PBE->>BE: Get launch URL for user with required params
        BE-->>PBE: Launch URL
        PBE-->>PWA: Launch URL
    end


    rect rgb(235, 230, 255)
        Note over PWA, BE: Capture image and Submission processing
        PWA->>WA: Invoke flow
    alt Device Have Camera
        rect rgb(2255, 245, 230)
            note over WA: Capture image(s)
            WA->>BE: Start submission processing
            note over BE: Submission Processing
            note over WA: Status Polling
            WA->>WA: Do next action:<br>- RETRY (From Capture Image)<br>- STATUS (Show IAB status screen)<br>- EXIT (Completed)
        end

    else Device doesn't have any camera
        rect rgb(254, 249, 235)
            note over WA: Display QR code on the screen
            User->>WA_Mobile: Scan QR code and open FR flow
            note over WA_Mobile: Capture image(s)
            WA_Mobile->>BE: Start submission processing
            note over BE: Submission Processing
            note over WA_Mobile: Status Polling
            WA_Mobile->>WA_Mobile: Do next action:<br>- RETRY (From Capture Image)<br>- STATUS (Show IAB status screen)<br>- EXIT (Completed)

            WA->>WA: Do next action:<br>- STATUS (Show IAB status screen)<br>- EXIT (Completed)
            User->>WA: Clicks CTA on success/error screen (when nextAction is STATUS)
            WA->>PWA: Sends callback to partner with status=COMPLETED/ERROR and error_code
        end
    end

    rect rgb(230, 245, 255)
        Note over PWA, BE: Get Result Details
        BE->>PBE: Submission Processing Compete Callback
        PWA->>PBE: Call "Get Submission Details" API <br/>(correlationId aka partner session id)
        PBE->>BE: Call "Get Submission Details" API (correlationId, partner token)
        BE-->>PBE: return submission details
        PBE-->>PWA: Continue processing
    end

    Note over PWA: Show/process result
    end

Detailed Steps:

Partner BE calls the Generate Partner Token API on IAB BE to generate partner token, with client-id and pass-key provided by IAB.
- This API returns a partner token along with its validity in response. Partner BE can use the same partner token for making multiple requests as long as the token is valid.
- Once the token gets expired, partner BE can generate a new token using the same API.
- This token needs to be passed in all subsequent API calls to IAB BE for authentication and authorisation.
Partner BE calls the Initiate Flow API on IAB BE to generate the launch URL which will open the IAB flow. This API exposes several configuration parameters which allows the partner to customise the flow as per their requirements for which you can refer to the Web SDK Guide mentioned under the Integration Contracts section.
The IAB supports two modes: launching the flow directly on the device, or displaying a QR code (Smart QR Mode) for the user to continue on a mobile device.
- Smart QR mode is disabled (Default): The user proceeds directly to the flow.
- Smart QR mode is enabled: the IAB FE detects whether the user's device has a camera.
  - Device has a camera:
    - The user proceeds to the onboarding screen of the corresponding flow.
    - The IAB FE captures the user's image(s) and uploads them to the IAB BE for processing.
  - Device does not have a camera:
    - The IAB FE displays a QR code on the screen.
    - The user scans the QR code with a mobile device and completes the flow in their mobile browser.
    - The IAB FE captures the user's image(s) from the mobile device and uploads them to the IAB BE for processing.
For processing the image(s), partner needs to expose an API which IAB BE will call to get the reference Image. The image(s) captured by IAB FE will be compared against this reference image.
IAB web app will poll IAB BE until the processing is done and show loader to the user in the meantime.
Once the processing is done, IAB BE will return the relevant next action to IAB FE.

Partner can set custom success / failure page when the process is done
If not set, IAB will use default success / failure page for IAB Web SDK.

To get the result of the submission, the Partner BE will call the Get Submission Details API on the IAB BE with the following relevant inputs:
- x-partner-session-id
- x-partner-user-id
- x-partner-user-id-type
- x-onekyc-token (partner token)
IAB BE will return the submission result to partner BE.

Integration Contracts

Document Name	Link
BE API Guide	BE API Guide
Web SDK Guide	Web SDK Guide
Android SDK Guide	Android SDK Contract
Flutter SDK Guide	Flutter SDK Contract
iOS SDK Guide	iOS SDK Contract

Updated about 2 months ago

Documentations

Face Verification Flow - User Experience

Did this page help you?