Add Face Liveness Detection to Any App in 10 Lines of Code (Free Tier Available)

Muhammad Yusuf Abubakar — Sun, 09 Aug 2026 08:41:46 +0000

Most biometric verification tools are either expensive, require a hardware SDK, or lock you into a proprietary platform. FaceID API is a free-tier REST API that adds face liveness detection to any web or mobile app. Here's exactly how it works.

How the session model works

Your API key never appears in frontend code or in a URL.

Your backend
   ↓ POST /widget-session (X-API-Key: your_secret_key)
FaceID Worker
   ↓ Returns { session_id, widget_url }
Your frontend
   ↓ Opens widget_url in an iframe (no key in URL)
User completes liveness
   ↓ postMessage({ type: 'FACEID_RESULT', result: {...} })
Your frontend
   ↓ Receives the result — no raw biometric data

Node.js backend

// Step 1: get a session (server-side only — never in the browser)
const session = await fetch('https://face-worker.faceidentity.workers.dev/widget-session', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.FACEID_API_KEY,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    person_id: user.id,     // your user's unique ID
    name: user.name,        // shown on the success screen
    mode: 'authenticate',   // 'register' | 'verify' | 'authenticate'
  }),
});

const { widget_url } = await session.json();
// send widget_url to your frontend

// Step 2: frontend — open the widget
const iframe = document.createElement('iframe');
iframe.src = widget_url; // session token in the URL, not the API key
iframe.allow = 'camera';
iframe.style.cssText = 'position:fixed;inset:0;width:100%;height:100%;border:none;z-index:9999';
document.body.appendChild(iframe);

// Step 3: receive the result
window.addEventListener('message', (e) => {
  if (e.data?.type === 'FACEID_RESULT') {
    document.body.removeChild(iframe);
    const { action, match, person_id, name } = e.data.result;
    // action: 'registered' | 'verified' | 'authenticated'
    // match: true | false (for verify/authenticate)
  }
});

Python backend

import requests, os

def start_verification(user_id, user_name, mode='authenticate'):
    response = requests.post(
        'https://face-worker.faceidentity.workers.dev/widget-session',
        headers={
            'X-API-Key': os.environ['FACEID_API_KEY'],
            'Content-Type': 'application/json',
        },
        json={'person_id': user_id, 'name': user_name, 'mode': mode}
    )
    return response.json()['widget_url']

Three modes

register — first-time enrollment. Returns action: 'registered'.
verify — 1:1 match, requires person_id. Returns match: true/false.
authenticate — 1:N search across your project, no person_id needed. Returns match: true with person_id and name if found.

What happens during liveness

The widget runs a 4-direction head challenge (up, down, left, right) plus a mouth-open check. MediaPipe FaceMesh tracks 468 facial landmarks in real time in the browser; face-api.js generates the 128-float descriptor only after every challenge passes. That descriptor — a mathematical representation, not a photo — is the only thing that ever reaches the server.

Get started

faceidentity.site — 200 enrollments/month free, no credit card.

How I Built an Enterprise Biometric API From a $0 Budget and an Android Phone

Muhammad Yusuf Abubakar — Sun, 09 Aug 2026 08:30:45 +0000

I don't own a laptop. I don't have a funded startup. I'm a self-taught developer from Nigeria, and six months ago I decided to build the kind of face-verification technology used in banking and identity-verification apps — using nothing but my Android phone.

This is the story of FaceID API.

What I built

FaceID is a production-ready biometric face verification API. Any developer can add face liveness detection to a web or mobile app in under 10 minutes. It handles:

A 4-direction head challenge plus a mouth-open check for liveness
A 128-float mathematical face descriptor — no photo is ever stored
Three modes: Register (enroll), Verify (1:1 match), Authenticate (1:N search)
Full project isolation, so each developer's user data stays separate

The whole thing runs on Cloudflare Workers with Cloudflare D1 as the database. No server to manage, no Docker, no monthly VPS bill.

The architecture

User camera (browser)
      ↓
MediaPipe FaceMesh (runs locally — nothing sent yet)
      ↓
face-api.js generates a 128-float descriptor
      ↓
Cloudflare Worker (edge, 300+ global locations)
      ↓
Cloudflare D1 (SQLite at the edge)
      ↓
Result: { match: true/false, person_id, name }

The photo never leaves the device — that's not a marketing line, it's how the math works. A 128-float descriptor is a point in 128-dimensional space. You can't reverse it into a face image any more than you can reverse a hash back into the original text.

The security model

Before publishing, I read every "vibe-coded apps have vulnerabilities" thread I could find. Here's what's actually implemented:

One-time widget tokens with a 3-minute TTL. Your API key lives on your server — you call /widget-session, get back a single-use URL, and embed that in an iframe. The key never touches a browser.
Admin access is controlled by a hardcoded email in a Cloudflare environment secret, not a database column — so it can't be escalated through a SQL injection.
HMAC-SHA256 signature verification on every billing webhook; replayed requests are rejected.
Suspending a project invalidates all active sessions immediately.
Rate limiting per IP, per endpoint (10 registrations/min, 30 verifications/min).

It isn't a certified, third-party-audited system, and I want to be upfront about that. But every protection in it was built because I understood the specific attack it closes off, not copied from a template.

What I built it with

Termux (terminal emulator on Android)
proot-distro (Ubuntu environment inside Termux)
Wrangler CLI (Cloudflare's deployment tool)
Python 3 for file operations
One Android phone

That's the complete hardware list.

Pricing

Only successful new face enrollments count against your quota. Verifications and authentications are always free and unlimited — so a user logging in twice a day costs you nothing extra.

Free: 200 enrollments/month, 1 project
Starter: 2000 enrollments/month, 3 projects — $9/month
Pro: 20,000 enrollments/month, unlimited projects — $29/month

Try it

Sign in at faceidentity.site with Google — free, no card required. Integration is about 10 lines of backend code in JavaScript, Python, PHP, Go, or Dart; the widget handles the camera, UI, and liveness challenges.

If you're a developer in Africa, South Asia, or anywhere resources are limited, I hope this shows the barrier to building real things is lower than people tell you.

— Muhammad Abubakar Yusuf, faceiddevelopersupport@gmail.com

DEV Community: Muhammad Yusuf Abubakar

Add Face Liveness Detection to Any App in 10 Lines of Code (Free Tier Available)

How I Built an Enterprise Biometric API From a $0 Budget and an Android Phone