Guided capture
Auto-capture fires only when the frame is worth keeping: edges found, glare and blur rejected, wrong side detected and coached — before a single byte leaves the phone.
✓ quality-gated frames, wrong-side coaching
KYC identity-signal API · Mozambique & Mexico
Verify identities. One API, one hosted flow.
thibit reads an ID document, checks its authenticity signals, and matches the selfie to the document photo — then returns an advisory assessment over a simple API and a hosted page your users open on their phone. You make the decision. For the Mozambican BI or passport and the Mexican national ID (INE) or passport.
Sign in with Google or GitHub and mint your first verification flow in minutes from the portal — no sales call, no contract to start.
What your user sees · what the engine proves
Every applicant moment is an engine truth.
The words on the left of each card are the flow's own Portuguese — lifted verbatim from the hosted onboarding. Under each one: what the engine is actually doing at that moment.
Machine-readable cross-check
ICAO 9303 MRZ check digits validate the document arithmetic, and what the engine reads is reconciled against the record you sent — so a genuine ID that belongs to someone else raises a divergence flag.
✓ MRZ check digits + record match
Active liveness
Blink, turn, nod — a challenge sequence checked server-side, plus a face match against the document photo. Liveness and presentation-attack signals are assessed conservatively: a suspicious capture is routed to manual review, not guaranteed to be blocked.
✓ server-checked challenge + face match
Signed webhook to your backend
The moment the applicant is done, your endpoint receives the assessment — HMAC-signed, PII-free by default, with the full evidence dossier behind your authenticated API key.
✓ HMAC-signed · advisory · you decide
For developers
Then it lands in your backend.
One event per verification, signed with your whsec_
secret and delivered with retries. The default envelope is PII-free —
summary_reasons carries machine-readable reason codes, and the full
evidence dossier stays behind the authenticated API. The assessment is advisory by
design: the decision, and the legal duty, remain yours.
POST https://your-app.example/webhooks/thibit X-Thibit-Event: verification.completed
{
"event": "verification.completed",
"id": "1d5c1f6a-6c1e-4b0a-9f3e-2f9be14c7d10", // verification id
"type": "kyc",
"status": "completed",
"assessment": "no_material_concerns",
"advisory": true,
"confidence": 0.93,
"summary_reasons": [],
"evidence_available": true
} Get started
Ship verification this week.
Sign in, author a flow, and open the hosted link on your phone. We're pre-launch — early integrators work directly with the team.