The /v1 API
Create a verification with the documents you accept, get a hosted onboarding_url, and receive the assessment by HMAC-signed webhook or by polling. Project-scoped, rotatable API keys.
KYC identity-signal API · Mozambique & Mexico first
Verify identities. One API, one hosted flow.
thibit reads an ID document, checks its authenticity signals, and matches the selfie to the document photo — then returns an advisory assessment over a simple API and a hosted page your users open on their phone. You make the decision. Tuned for Mozambique and Mexico; passports from any country.
create a verification
/v1POST https://api.thibit.id/v1/flows/default-kyc/intake
X-API-Key: tk_test_…
{
"country": "MZ",
"document_type": "auto",
"verifiee": {
"your_internal_id": "usr_998"
}
}Response
{
"id": "ver_…",
"status": "collecting",
"onboarding_url": "https://onboard…/?token=…"
}Two surfaces, one record
You create it. Your user completes it.
The developer decides what a verification accepts; the applicant just follows the link.
The mobile flow
Your user opens the link, picks one of the documents you allowed, photographs it, and completes a selfie with a liveness challenge. Mobile-first, Portuguese-first, no thibit account. You only see the result.
Plus a developer dashboard: sign in with Google or GitHub to author a verification flow once in Build, activate it as a shareable hosted link in Flows, and review every run in Verifications — or run a flow straight from your backend by POSTing the data you already hold.
What it verifies
One engine. Document, authenticity, liveness.
Every check runs in one in-house engine — no per-vendor integrations to wire up or keep in sync.
Documents
Mozambican Bilhete de Identidade and passport, Mexican INE and passport with full per-country tuning — plus passports from any country via ICAO 9303 MRZ check digits: accepted and processed, review-based while per-country calibration matures.
Authenticity
A vision-model document-authenticity check combined with EXIF/metadata fingerprints surfaces edited, photoshopped, or re-captured images (screens and prints) as evidence for review.
Liveness & face match
Guided capture with quality gating, an active liveness challenge — blink, turn, nod — verified server-side, and a face match against the document photo. Anti-spoof signals stay conservative and review-biased while calibration matures.
Match against your records
Verify the person matches your records — not just that the ID is real.
When you start a verification, send the person you already have on file — their name, date of birth, ID number. thibit compares what it reads off the document against your record and flags any divergence, so a genuine ID that belongs to someone else does not slip through.
Send your record
POST the name, date of birth, and ID number you already hold when you run a flow. It pre-fills capture for your user, too.
Get a divergence flag
thibit reconciles collected vs claimed and names any name / DOB / number mismatch — a read-only signal alongside the engine’s assessment.
How it works
Three steps from zero to an assessment.
1
Author
Compose a Flow from pre-built Capture, Check, and Decide pieces (OCR, liveness, metadata checks) in your dashboard.
2
Collect
Send the applicant to your Flow URL. They photograph their ID and complete a guided liveness challenge on their phone. No app needed.
3
Review
The engine returns an advisory assessment — no_material_concerns, manual_review_recommended, material_inconsistency, or assessment_incomplete — with the evidence behind it. You review and make the decision in Case Management.
Status moves collecting → pending → processing → completed. See the quickstart for working curl.
Who it's for
Built for the developer who ships onboarding.
Developers
A clear /v1 API, HMAC webhooks, and a hosted redirect — first integration in an afternoon. Sign in to a dashboard to manage projects and keys, author a flow once in Build, share its hosted link, and review every run in Verifications.
Read the docs →Your users
A Mozambican with a BI, a Mexican with an INE, an expat with a passport — each opens a link and completes verification on their phone in minutes, with a clear path if a document is unreadable.
What thibit is — and isn't
Document & liveness signals. Nothing you didn't ask for.
Engine-only
One in-house verification engine — OCR, template match, document authenticity, liveness — behind a clean API. No vendor orchestration to maintain.
Mozambique & Mexico first
Per-country tuned templates for the Mozambican BI and Mexican INE, plus global passport coverage via ICAO MRZ so expats and foreign residents verify too. More countries and documents activate as their calibration completes.
Assessments by webhook
Every assessment is delivered HMAC-signed and kept in a read-only verification log you can review.
Advisory by design
thibit is not a sanctions/PEP/AML database, a fraud score, or an identity wallet. It returns an advisory identity-signal assessment that supports your KYC process — under frameworks such as Mozambique's Lei nº 3/2017, the decision and the legal duty remain yours. Use of thibit alone does not discharge legal or regulatory obligations.
Ship verification this week.
Sign in, author a flow, and open the hosted link on your phone. We're pre-launch — early integrators work directly with the team. No local KYC API existed for Mozambique, so we built one.