Brazil Identity Verification API: What Data You Can Get from a CPF

Introduction

When a product team outside Brazil starts onboarding Brazilian users, the first question is usually: what can we actually verify? Brazil has no single public identity API. Instead, identity checks revolve around the CPF (Brazil's individual taxpayer ID) and the data linked to it, plus document and biometric checks.

This article explains what a Brazil identity verification API can return, what each data point is good for, and how the products of CPFHub.io map to each need.

The data you can verify from a CPF

Name, gender and date of birth

The most common check. Given a CPF, the Simple Lookup returns the holder's full name, gender and date of birth. You compare them with what the user typed:

• A real CPF with a different name or date of birth points to a borrowed or stolen identity.
• A CPF that does not exist points to a made-up number that passed the check digit algorithm.

curl --max-time 10 \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Accept: application/json" \
  https://api.cpfhub.io/cpf/00000000000

{
  "success": true,
  "data": {
    "cpf": "00000000000",
    "name": "Fulano de Tal",
    "nameUpper": "FULANO DE TAL",
    "gender": "M",
    "birthDate": "15/06/1990",
    "day": 15,
    "month": 6,
    "year": 1990
  }
}

A CPF that is not found returns 404 and does not use a credit.

Registration status and year of death

The Receita Federal (Brazil's federal tax authority) keeps a registration status for each CPF: regular, pending regularization, suspended, cancelled, null, or holder deceased. The Real-Time Lookup queries the Receita Federal at the moment of the call and returns:

• the holder's name and date of birth,
• the registration status (situation),
• the year of death, when there is one (deathYear),
• a link to the proof issued by the Receita Federal, useful for audit trails.

It requires the CPF and the holder's date of birth, a requirement of the Receita Federal itself. Use it when the risk justifies it: credit, payouts, regulated onboarding, or checking that a customer is still alive.

Age

Because the lookups return the date of birth, the same call tells you whether the CPF holder is over 18. Combined with the name match, that is the basis of age verification. Brazil's ECA Digital (Brazil's digital child protection law) raised the bar for age checks on platforms that minors may access, which makes this one of the most common uses. See age verification.

Beyond the CPF: document and biometric checks

A CPF lookup proves that an identity exists and matches. It does not prove that the person typing it is that person. For that, regulated flows add:

• Liveness detection: the user is a live person in front of the camera, not a photo, a screen or a mask.
• Face match: the selfie matches the photo on the identity document.
• Document reading: name, document number, CPF and date of birth are read from the RG, the CNH (driver's license) or a passport, and cross-checked with the CPF data.

CPFHub.io's Identity Verification runs these three steps through the same API key. It is the layer to use for fintech and crypto account opening, payouts and other high-risk flows.

Companies: the CNPJ

If you also onboard businesses (sellers, merchants, suppliers), the CNPJ Lookup returns company registration data from the CNPJ (Brazil's company taxpayer ID), the basis of KYB in Brazil.

Choosing the right check

A good default for most platforms is the Simple Lookup at signup for everyone, and Identity Verification only when the user reaches a risky action, such as a first withdrawal.

Integration notes

• Keep the API key on your server. Your frontend calls your own backend route, which calls the API with the x-api-key header.
• Handle both error shapes. Lookup errors return an error object with a message, and authentication errors return error as a string.
• Respect rate limits. A 429 comes with a Retry-After header and is not charged.
• AI agents: the API is also available through an MCP server, so assistants and agents can verify a CPF directly.

Full reference in the documentation. Biometric data is sensitive data under the LGPD, Brazil's data protection law, so state the legal basis (usually fraud prevention) in your privacy notice.

Frequently asked questions

Is there a free government API to verify a CPF?

Not for automated checks. The Receita Federal offers a public status page for one CPF at a time, with a captcha, which does not fit signup flows. Automated verification goes through a paid API.

What data does a CPF lookup return?

The CPFHub.io Simple Lookup returns the holder's name, gender and date of birth. The Real-Time Lookup adds the registration status at the Receita Federal, the year of death when there is one, and the proof link.

Can I verify an identity without a selfie?

Yes, at a lower level of assurance. A CPF lookup with name and date of birth matching confirms that the identity exists and matches. Only document and biometric checks show that the user is the real holder.

How much does a lookup cost?

Plans start with 50 free credits per month and no credit card. A CPF that is not found does not use a credit. See pricing.

Read also

• What Is a Brazilian CPF? A Guide for Foreign Companies
• How to Verify a Brazilian CPF Number
• Brazil KYC Requirements in 2026: What Foreign Companies Need to Know

Conclusion

A Brazil identity verification API is not one check but a set of them, all anchored on the CPF: existence and match, registration status at the Receita Federal, age, and document plus biometric proof for higher-risk flows. Pick the lightest check that covers your risk, and escalate only when the user's action calls for it.

Test it with 50 free credits and no credit card at cpfhub.io.