Face Scan
000
Passwordless biometric identity

Prove it's a real, live human.
In one line of code.

Face Scan is a drop-in identity provider. Add webcam liveness and Sign in with Face Scan to any site — on-device inference, a trained anti-spoof model, challenge-response, and server-signed ES256 tokens.

View integration
<script src="/sdk/facescan.js" defer></script>
  • On-device inference
  • OIDC + PKCE
  • ES256 signed tokens
< 3smedian verify
100%on-device inference
ES256signed proofs
3SDKs: Web · iOS · Android
Live demo

See it for real

These buttons call the actual SDK loaded on this page. Your camera stays on your device — only a signed proof leaves the browser.

Liveness widget

Verify a live human

Runs the webcam liveness modal, then returns a server-signed liveness token and score.

Result appears here after a check.
OIDC login

Sign in with Face Scan

The branded button below is rendered by FaceScan.renderButton. It launches passwordless OIDC login.

Sign-in outcome appears here.
How it works

Trust in three moves

Inference runs client-side for instant UX. Trust comes from a server-issued challenge nonce and a signed proof you verify on your backend.

  1. 01

    Request a challenge

    Your page calls checkLiveness(). The SDK asks Face Scan for a one-time nonce and an ordered challenge sequence — blink, turn, smile.

  2. 02

    Scan on device

    MediaPipe FaceMesh drives the active challenges while our ONNX anti-spoof model scores every frame. The neon ring fills as confidence accrues.

  3. 03

    Verify the proof

    Face Scan mints an ES256 liveness token bound to the nonce. Your backend verifies it against JWKS — or posts it to /liveness/verify-token.

Products

One platform, every surface

Web SDK

A single facescan.js script. Dark-neon liveness modal, FaceMesh + ONNX anti-spoof, auto-attach buttons. Verify server-side with one call.

  • Passive + active liveness
  • WASM / WebGPU inference
  • Graceful active-only fallback

iOS & Android SDKs

Native enrollment with the device key held in the Secure Enclave. Approve web logins by scanning a QR — signatures are ECDSA P-256.

  • Secure Enclave device keys
  • Vision active liveness
  • QR / pairing-code approval

Sign in with Face Scan

Full OIDC Authorization Code + PKCE. Drop a branded button, get an ES256 id_token with amr:["face","liveness"]. No passwords, ever.

  • Standard OIDC discovery + JWKS
  • Mobile-approval or web-only
  • Works with your existing RP
Security

Anti-spoof by design

Photos, videos, and masks don't pass. Every proof is bound to a fresh server nonce and cryptographically signed.

On-device inference

Frames never leave the browser by default. Our trained anti-spoof model runs locally via onnxruntime-web.

Trained anti-spoof model

A purpose-built liveness model scores presentation attacks — screens, prints, and replays — frame by frame.

Challenge-response

The server issues an ordered, one-time challenge sequence per session. Replays fail because the nonce won't match.

ES256 signed tokens

Liveness and identity tokens are ES256 JWTs signed with kid=faceScan-key-1, verifiable against public JWKS.

Integration

Copy, paste, ship

Two tags to load the SDK, one button to verify a human. That's the whole liveness integration.

index.html 
<!-- 1. Load the SDK -->
<script src="http://localhost:4000/sdk/facescan.js" defer></script>
<script>
  FaceScan.init({ clientId: "demo-web", baseUrl: "http://localhost:4000" });
</script>

<!-- 2. Auto-attach a liveness button -->
<button data-facescan-liveness data-on-success="onLive">
  Verify I'm human
</button>

<script>
  function onLive(result) {
    // { ok, livenessToken, score, engine, challengesPassed }
    await fetch("/api/verify", {
      method: "POST",
      body: JSON.stringify({ token: result.livenessToken })
    });
  }
</script>
signin.html 
<!-- Sign in with Face Scan -->
<div id="signin"></div>

<script>
  FaceScan.renderButton("#signin", {
    scope: "openid profile email",
    onSuccess: (r) => console.log("code", r.code),
    onError:   (e) => console.warn(e)
  });
</script>

// Verify a liveness token server-side:
//   POST /liveness/verify-token { livenessToken }
//   -> { valid, score, clientId, live }
Pricing

Start free. Scale when you're real.

Placeholder plans for the MVP — every tier ships the full anti-spoof stack.

Starter

$0/mo

For prototypes and side projects.

  • 1,000 liveness checks / mo
  • Web SDK
  • Sign in with Face Scan
  • Community support
Try it live
Most popular

Pro

$149/mo

For growing products in production.

  • 100,000 liveness checks / mo
  • Web + iOS + Android SDKs
  • Server re-scoring of frames
  • Custom challenge sequences
  • Priority support
Start Pro

Enterprise

Let's talk

For scale, compliance, and SLAs.

  • Unlimited checks
  • Dedicated tenancy & SSO
  • On-prem model hosting
  • Custom liveness thresholds
  • 99.95% uptime SLA
Contact sales

Ship liveness before your coffee's cold.

One script. One button. A real, live human — proven.