Identity verification · KYC
Identity verification
with liveness detection.
A liveness selfie, a photo of the ID document and face matching in a single flow. Send a link or integrate through the API and get the decision.
In a pilot with selected companies. Talk to us to join.
In practice
From document to decision, in a single flow.
{ "status": "approved", "reasons": [] }What gets checked
Three checks, one decision.
A CPF tells you the person exists. Identity verification confirms that whoever is in front of the camera owns the document.
Liveness detection
Confirms a real person is in front of the camera, live. They center their face in an oval for a few seconds, and the analysis blocks photos, screens, masks and injected video.
liveness.statusliveness.confidenceFace match
Compares the selfie with the photo on the document. Below the threshold, it is rejected. Close to the threshold, it goes to human review instead of being approved automatically.
faceMatch.similarityDocument reading (OCR)
Brazilian ID (RG), driver's license (CNH, front and back) and passport. Reads name, parents' names, document number, issuing authority, CPF, date of birth and expiry, plus the passport MRZ.
fullNamedocumentIdcpfbirthDateexpiryDateNetwork and device signals
Each verification records the IP and flags Tor, VPN and datacenter IPs, plus the country of origin and the browser fingerprint, so your team can assess suspicious cases.
isTorisVpnisDatacenterHow it works
From link to decision, in four steps.
The person does everything on their phone, guided screen by screen. Your team follows along in the dashboard or gets the result in your system.
- 01
Create the verification
Generate a link in the dashboard or through the API. Through the API you also set the expiry, the number of attempts and where the person lands at the end.
- 02
Liveness selfie
The person opens the link on their phone. On a computer, a QR code hands off to the phone, or they continue with the webcam. Live camera only: no photos from the gallery.
- 03
Document photo
RG, CNH or passport, photographed with the camera, front and back when the document has two sides. The CPF is read from the document, no typing.
- 04
Get the decision
Approved, under review or rejected, with the reasons. It arrives through a signed webhook and stays in the dashboard with the images and extracted data.
curl -X POST https://api.cpfhub.io/v1/kyc/links \
-H "x-api-key: $CPFHUB_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"externalId": "user_4821",
"redirectUrl": "https://example.com/kyc/done",
"expiresInMinutes": 1440,
"maxAttempts": 3
}'{
"event": "kyc.decision",
"verificationId": "c1f0b7e2-…",
"linkId": "7a4d93c5-…",
"externalId": "user_4821",
"status": "approved",
"decidedBy": "automatic",
"reasons": [],
"occurredAt": "2026-10-14T13:02:11Z"
}The webhook carries no name, CPF or images. That data stays in the dashboard, with controlled access.
Anti-fraud
What liveness detection blocks.
A plain selfie accepts a photo of a photo. Liveness detection analyzes a short live video and rejects anything that is not a real person in front of the camera.
Printed photo
A paper or cut-out photo held in front of the camera.
Photo or video on a screen
Someone else's image shown on a phone, tablet or monitor.
Masks
Paper masks and 3D masks made of silicone or latex.
Deepfakes and injected video
Recorded or synthetic video fed in place of the camera.
Ready-made gallery photo
The flow takes no uploads: selfie and document only through the live camera.
Reused link
Each link has an expiry and an attempt limit, and closes once the verification is approved.
Liveness is a strong signal, not an absolute guarantee. That is why borderline cases go to human review, and with review turned off they are rejected, never approved automatically.
Integration
No code or through the API.
Start by sending links from the dashboard. When you want to automate, the same verification runs through the API.
Verification link
A ready-made CPFHub.io page that works on any phone.
- Generate it in the dashboard and send it by WhatsApp, email or SMS
- QR code from computer to phone
- Every link expires and has an attempt limit
- Closes on its own once the verification is done
REST API
Create links and track results from your own system.
- Same x-api-key as the CPF lookups
- Signed webhook (HMAC-SHA256) on every decision
- Configurable expiry, attempts and return to your site
- Your own identifier (externalId) in the status and the webhook
Dashboard
Human review with an audit trail.
Every verification lives in the CPFHub.io dashboard, with the images, the extracted data and the history of each decision.
Searchable history
Search, filters by status and period, and CSV export.
High-resolution images
Selfie and document in full screen, with a magnifier to check details.
Decisions with a reason
Approving or rejecting requires a justification, and the decision can be revisited later.
Immutable history
Every status change is recorded: who decided, when and why.
Per-account rules
An expired document goes to review or is rejected, and human review can be turned on or off. Your choice.
Cross-check with our database
Optional: match the name and date of birth on the document against the CPF in the CPFHub.io database.
Where to use it
When a CPF is not enough.
For sign-ups where you need to know the person is who they claim to be, not just that the CPF exists.
Fintech and lending
Account opening, credit and anti-money laundering.
Crypto
Customer onboarding with identity evidence.
Limits
What is checked and what is not.
Identity verification is one layer. Knowing exactly what it covers keeps you from over-trusting the result.
- Is a real person on camera?Yes, checked by liveness detection.
- Is it the same face as on the document?Yes, checked by face match.
- Is the document data read?Yes, by OCR. It is not checked against a government database.
- Does it check the CPF status at the Federal Revenue?No. Use the Real-Time Lookup for that.
- Does it detect tampered documents?There is no document forensics yet. Mismatches and failed readings go to review.
- Is the digital driver's license (CNH Digital) accepted?Not yet. A screenshot does not prove the CNH Digital is authentic.
CPFHub.io delivers the checks and the automatic decision. Your acceptance policy and your industry's obligations remain with your company.
LGPD
Biometrics are sensitive data. The flow is built for that.
Biometric data has its own rules under Brazil's data protection law (LGPD, art. 11). The verification was designed to collect only what is needed.
Consent on the first screen
A short notice before the camera, with the accepted version recorded on every verification.
Clear roles
Your company is the controller. CPFHub.io acts as the processor.
Private images
Selfie and document in private storage, accessible only through the dashboard.
Webhook without personal data
The account webhook carries status and reasons. Name, CPF and images stay in the dashboard.
Frequently asked questions
What is identity verification (KYC)?
KYC (Know Your Customer) is the process of confirming a person is who they claim to be before opening an account or granting access to a service. At CPFHub.io, identity verification combines three checks: liveness detection, document reading and matching the selfie against the document photo.
What is the difference between liveness detection and identity verification?
Liveness detection confirms that a real, present person is in front of the camera, not a photo, screen or video. Identity verification goes further: it matches that face against the document and reads the document data. Liveness alone does not tell you who the person is. That is why selfie and document are always required at CPFHub.io.
Does liveness detection catch deepfakes and photos of photos?
Yes. The analysis blocks printed photos, photos or videos shown on another screen, paper, silicone or latex masks, and recorded or synthetic (deepfake) video injected in place of the camera. On top of that, the flow only accepts the live camera, with no uploads. No technology is infallible: borderline cases go to human review.
Which documents are accepted?
Brazilian ID (RG), driver's license (CNH, front and back) and passport, photographed with the camera on the spot. The digital driver's license (CNH Digital) is not accepted yet, because a screenshot does not prove it is authentic.
Does identity verification check the Brazilian Federal Revenue?
No. It confirms the person and reads the document, but does not check the CPF registration status. The Real-Time Lookup does that. As an option, you can also cross-check the name and date of birth on the document against the CPF in the CPFHub.io database.
Does it work on a computer?
Yes. On a computer, the page shows a QR code to continue on the phone, which usually has the better camera. People who prefer can continue with the webcam.
How do I get the result?
Three ways: in the CPFHub.io dashboard, through a signed webhook on every decision, or by querying the link through the API. The status is approved, under review or rejected, always with the reasons. The account webhook carries no name, CPF or images.
Can I collect biometrics under the LGPD?
Yes, with a proper legal basis. Biometrics are sensitive personal data (art. 11 of the LGPD), and fraud prevention in identification is one of the bases the law provides. The flow shows a consent notice before the camera and records the accepted version. Your company is the data controller and CPFHub.io acts as the processor. Confirm the legal basis with your legal team.
How much does it cost and when is it available?
Identity verification is in early access with a group of selected companies. The price per verification will be published at launch. To join the pilot, talk to us on WhatsApp.
Know who is
on the other side.
In early access for selected companies.
- Liveness
- ID document
- Face match