Face Biometrics
Endpoints for enrolling a face with FaceTec, re-verifying it, and checking enrollment status. Enrollment is a one-time operation and is required before saving a keyshare backup. Once a face is enrolled, keyshare recovery and new-device registration need a fresh match scan.
| Method | Endpoint | Description |
|---|---|---|
| POST | /v2/auth/face/init-session | Relay the FaceTec Device SDK's one-time initialization request |
| POST | /v2/auth/face/process | Create or continue an enrollment or match scan |
| GET | /v2/face | Get the user's face enrollment status |
How a scan works
The FaceTec Device SDK runs a scan as a series of request-response steps. At each step, it produces a requestBlob and waits for the corresponding responseBlob from FaceTec Server.
The app sends each requestBlob to /v2/auth/face/process. Auth-svc adds the user's server-side reference, forwards the request to FaceTec Server, and returns the responseBlob for the app to pass back to the Device SDK.
The first /v2/auth/face/process request for a scan creates a face session and returns its face_session_id. The app includes that ID in every later request for the same scan. It continues this exchange until completed is true; succeeded then indicates whether the scan passed.
When a match scan completes with succeeded: true, its face_session_id becomes one-time proof for keyshare recovery, device registration, or the combined register-and-recover flow. The session expires FACETEC_SESSION_EXPIRY_SECONDS after the match completes, which is 300 seconds by default, and is consumed when one of those operations accepts it.