Face Authentication API for Web Apps

Building facial authentication from scratch means handling liveness checks, anti-spoofing, recognition engine behavior, matching quality, and cross-browser camera capture before you can ship the actual product workflow. It is infrastructure work with security and privacy consequences.

FACEIO packages those layers into a managed API and browser SDK. Your application receives a Facial ID and authentication result, while your backend remains responsible for user mapping, session creation, authorization, and account recovery policy. Teams often pair this with the managed face authentication service for faster rollout.

The FACEIO API and fio.js SDK expose two core methods that cover the end-to-end authentication lifecycle. For endpoint-level controls, see the REST API reference.

• enroll()

  Starts the enrollment flow in the FACEIO widget. After explicit user consent, the configured facial recognition engine creates the non-reversible biometrics hash or application index entry, and FACEIO returns a unique Facial ID. Your backend stores that Facial ID against the user record.

• authenticate()

  Starts a live authentication flow, checks liveness, and returns the Facial ID with any associated payload after a successful match. Your backend can then validate the result and create a session, including passwordless sign-in flows described in Biometric Login for Web Apps.

Frontend integration is intentionally small. The SDK widget handles camera permissions, capture UI, and liveness checks inline, so your application does not need to implement those layers itself.

// Step 1 - embed the SDK in your page
<script src="https://cdn.faceio.net/fio.js"></script>

// Step 2 - initialize with your public App ID
const faceio = new faceIO('YOUR_APP_ID');

// Step 3 - enroll a new user
faceio.enroll({ locale: 'auto', payload: { userId: 'abc123' } });

// Step 4 - authenticate on return visits
faceio.authenticate({ locale: 'auto' })
  .then((data) => sendToBackend(data.facialId, data.payload))
  .catch((err) => handleError(err));

After a successful authenticate() call, send the returned facialId and payload to your server to create a trusted session. For a full walkthrough, see the integration guide, webhooks documentation, and security best practices.

The FACEIO API applies a full security stack on each authentication event. These controls are enabled by default, with no extra configuration required. For platform posture details, review the Trust Center.

• Liveness & Anti-Spoofing

  Each capture is checked for live human presence and designed to reject common presentation attacks, including photos, printed images, prerecorded video, screen replays, synthetic media, and mask attempts.

• Private API Key Validation

  Your backend validates authentication events using your private REST API key. Keep that key on the server so forged or replayed frontend responses are not treated as valid sessions.

• Application-Scoped Facial IDs

  Each App ID is isolated. Facial IDs, payloads, and recognition-engine indexes are scoped to the application, while platform-level rate limiting helps reduce brute-force attempts.

Most FACEIO integrations use one of two patterns, depending on trust and compliance requirements: