Identity verification API
PilotKYC checks identity documents, matches faces and detects spoofing for exchanges, P2P merchants, fintech and marketplaces. Send your user a link or call the API. Get a signed answer you can trust.
curl -X POST https://api.pilotkyc.com/v1/sessions \
-H "Authorization: Bearer pk_test_…" \
-H "Content-Type: application/json" \
-d '{
"mode": "selfie_document",
"reference_id": "user-1842",
"language": "en"
}'{
"decision": "approved",
"reasons": [],
"scores": {
"document_authenticity": 0.86,
"face_match": 0.81,
"liveness": 0.9
}
}How it works
Your backend calls one endpoint with the verification mode and your own reference id. You get back a unique link.
They open the link on their phone, photograph the document and, in selfie mode, take a live selfie. No app to install, no front-end work for you.
A webhook arrives with approved, declined or review, machine-readable reasons and 0..1 scores. Or poll the session whenever you like.
Verification modes
Two modes, one API. Supported documents: passport, national ID card and driver licence.
One photo of the document. Fast, low friction, ideal as a first gate.
Everything in the document check, plus proof that the person holding the phone is the person on the document.
Connectable per verification link or API session. Automatic screening against global counter-terrorism, sanctions and PEP databases for +0.01 USDT per check.
Result in 1–2 seconds for documents with a valid MRZ. Other documents read by the AI typically finish in 10–30 seconds with automatic failover. PilotKYC reads the front side or data page of the document.
Integration
Zero front-end work. Create a session, send the link, wait for the signed webhook.
Already have your own capture screens? Upload the images and get the answer in the same response.
Security & privacy
The best way to protect personal data is to not keep it. PilotKYC keeps as little as possible, for as short as possible.
Photos are processed and removed as soon as the check ends. They are never written to a database.
Extracted personal data is kept at most 30 days by default, and you can erase it through the API at any time.
Every webhook carries an HMAC-SHA256 signature with a timestamp, so you can reject forgeries and replays.
API keys are stored only as hashes. The plaintext is shown once, at creation. Keys are server-side only.
If recognition fails or times out, the result is review with a reason code. A technical error is never turned into an approval.
The hosted page never shows the decision, scores or extracted data to the browser. Only your server learns the outcome.
Developer experience
A small, predictable REST API with the details that matter in production.
Check the signature on the raw body, with a 5-minute tolerance and a constant-time compare. Failed deliveries are retried up to 8 times.
PilotKYC-Signature:
t=<unix_ts>,v1=<hex>
v1 = HMAC_SHA256(
webhook_secret,
t + "." + raw_body)Send an Idempotency-Key when creating sessions or checks. Retries within 24 hours replay the original response instead of creating duplicates.
Idempotency-Key: order-1842-kyc
→ Idempotent-Replayed: trueUse a pk_test_ key and choose the outcome with a keyword in the expected name. No recognition runs and no image is stored.
DECLINE → declined
REVIEW → review
UNREADABLE → declined
other → approvedUse cases
Onboard users with a document and face check before they trade or withdraw.
Confirm a counterparty is the person named on the order before releasing funds.
Add a verification step to account opening and limit upgrades.
Build trust between buyers and sellers by verifying who they are.
Why PilotKYC
What we deliberately do differently.
| Area | With PilotKYC |
|---|---|
| Your users' photos | Processed and deleted right after the check, never stored in a database. |
| Personal data | Short default retention, with a one-call erase through the API. |
| Getting started | Free sandbox keys with predictable outcomes, so you can test every branch before launch. |
| Integration effort | A hosted link needs no front-end work. A direct API is there when you want full control. |
| Decisions | Machine-readable reasons and 0..1 scores, not a black-box yes or no. |
| AML & Terrorist Screening | UN 1267, OFAC SDN, EU, Rosfinmonitoring, Interpol & PEP screening included for +0.00 USDT (Free), selectable per link. |
| Pricing | Transparent pay-as-you-go tiers: 0.04 USDT for Document check, 0.08 USDT for Selfie + Document (+0.00 USDT for AML). |
Pricing
Prepaid USDT balance via OxaPay. No monthly minimums, no setup fees. Charged only when a decision is produced.
Free
Build and test your integration.
document
0.04 USDT per verification
Fast document OCR, MRZ validation and tamper detection without a selfie step.
selfie_document
0.08 USDT per verification
Full biometric identity assurance: document verification + 1:1 face match + passive anti-spoofing.
Let's talk
High volumes or special requirements.
FAQ
Passports, national ID cards and driver licences. PilotKYC reads the front side or the data page of the document.
1–2 seconds for documents with a valid MRZ. Other documents read by the AI typically finish in 10–30 seconds with automatic provider failover. You are notified by webhook as soon as the decision is ready, or you can poll the session.
No. Images are processed and deleted right after the check and are never written to a database. Extracted personal data is kept at most 30 days by default and can be erased through the API at any time.
No hard failure was found, but at least one signal was not strong enough to approve automatically. You decide: queue it for a human, or ask the user to try again. Reason codes tell you why.
Yes. Sandbox keys are free and return deterministic outcomes, so you can build and test the full flow, including webhooks.
Yes — available as a +0.01 USDT add-on per check. Every verification link and API session supports full AML, sanctions and counter-terrorism screening across UN Security Council 1267 (Al-Qaida / ISIL), OFAC SDN, EU Financial Sanctions, Rosfinmonitoring (RF Terrorists & Extremists), Interpol Red Notices and global PEP lists. You can connect or disconnect AML screening when creating or editing any verification link.
Sign up in the dashboard, confirm your email and create API keys yourself: sandbox keys are free, live keys use your prepaid balance. Sign up
Top up a prepaid USDT balance in the dashboard with crypto via OxaPay (from 10 to 5000 USDT per top-up). Live verifications cost 0.04 USDT for Document check (mode=document) and 0.08 USDT for Selfie + Document (mode=selfie_document), charged only when a decision is produced; if our engine fails, the check is refunded automatically. Pay the exact amount shown on the invoice; if you paid a different amount, contact support.
Sign up, create a sandbox key, create a session and see a signed webhook arrive in minutes.