Authentication
Protected routes expect the service token in the Authorization header.
Authorization: Bearer your_token_here
Security: Keep the token on your server. The mobile app should call your backend, and your backend should call Checkface.
API Endpoints
POST/enroll-face
Store the official face. We keep a small crop and a numeric signature. Optional extra poses teach more angles.
curl -X POST https://face.check-outnow.com/enroll-face \
-H "Authorization: Bearer $TOKEN" \
-F "user_id=cus_2041" \
-F "photo=@face.jpg"
POST/liveness/session
Open a guided video session. The response lists the prompt order and how many seconds each prompt lasts.
{
"session_id": "...",
"challenges": ["center", "blink", "turn_left", "mouth", "smile"],
"seconds_per_challenge": 2,
"capture": "video",
"expires_in": 180
}
POST/liveness/video
Upload the one clip recorded in that prompt order. The score covers each movement, and FaceNet checks that the person matches the enrollment.
| Field | Required | Description |
| session_id | Yes | From the session response |
| clip | Yes | MP4 up to 8 MB and 12 seconds |
{
"authenticated": true,
"liveness_score": 82.5,
"challenge_scores": {"blink": 1, "turn_left": 0.8, "mouth": 1, "smile": 0.7},
"identity_matched": true,
"gallery_size": 2
}
POST/verify-face
Compare one photo with the enrolled signatures. Use the video route when the service needs a live person on camera.
curl -X POST https://face.check-outnow.com/verify-face \
-H "Authorization: Bearer $TOKEN" \
-F "user_id=cus_2041" \
-F "selfie=@selfie.jpg"
GET/learning-status?user_id=cus_2041
Returns how many signatures are stored for that person.