How I Built an Enterprise Biometric API From a $0 Budget and an Android Phone

I don't own a laptop. I don't have a funded startup. I'm a self-taught developer from Nigeria, and six months ago I decided to build the kind of face-verification technology used in banking and identity-verification apps — using nothing but my Android phone.

This is the story of FaceID API.

What I built

FaceID is a production-ready biometric face verification API. Any developer can add face liveness detection to a web or mobile app in under 10 minutes. It handles:

• A 4-direction head challenge plus a mouth-open check for liveness
• A 128-float mathematical face descriptor — no photo is ever stored
• Three modes: Register (enroll), Verify (1:1 match), Authenticate (1:N search)
• Full project isolation, so each developer's user data stays separate

The whole thing runs on Cloudflare Workers with Cloudflare D1 as the database. No server to manage, no Docker, no monthly VPS bill.

The architecture

User camera (browser)
      ↓
MediaPipe FaceMesh (runs locally — nothing sent yet)
      ↓
face-api.js generates a 128-float descriptor
      ↓
Cloudflare Worker (edge, 300+ global locations)
      ↓
Cloudflare D1 (SQLite at the edge)
      ↓
Result: { match: true/false, person_id, name }

The photo never leaves the device — that's not a marketing line, it's how the math works. A 128-float descriptor is a point in 128-dimensional space. You can't reverse it into a face image any more than you can reverse a hash back into the original text.

The security model

Before publishing, I read every "vibe-coded apps have vulnerabilities" thread I could find. Here's what's actually implemented:

• One-time widget tokens with a 3-minute TTL. Your API key lives on your server — you call /widget-session, get back a single-use URL, and embed that in an iframe. The key never touches a browser.
• Admin access is controlled by a hardcoded email in a Cloudflare environment secret, not a database column — so it can't be escalated through a SQL injection.
• HMAC-SHA256 signature verification on every billing webhook; replayed requests are rejected.
• Suspending a project invalidates all active sessions immediately.
• Rate limiting per IP, per endpoint (10 registrations/min, 30 verifications/min).

It isn't a certified, third-party-audited system, and I want to be upfront about that. But every protection in it was built because I understood the specific attack it closes off, not copied from a template.

What I built it with

• Termux (terminal emulator on Android)
• proot-distro (Ubuntu environment inside Termux)
• Wrangler CLI (Cloudflare's deployment tool)
• Python 3 for file operations
• One Android phone

That's the complete hardware list.

Pricing

Only successful new face enrollments count against your quota. Verifications and authentications are always free and unlimited — so a user logging in twice a day costs you nothing extra.

• Free: 200 enrollments/month, 1 project
• Starter: 2000 enrollments/month, 3 projects — $9/month
• Pro: 20,000 enrollments/month, unlimited projects — $29/month

Try it

Sign in at faceidentity.site with Google — free, no card required. Integration is about 10 lines of backend code in JavaScript, Python, PHP, Go, or Dart; the widget handles the camera, UI, and liveness challenges.

If you're a developer in Africa, South Asia, or anywhere resources are limited, I hope this shows the barrier to building real things is lower than people tell you.

— Muhammad Abubakar Yusuf, [e-mail]