Age & Identity Verification

Tuteliq Verification is a production-grade identity and age verification pipeline that combines document intelligence, biometric matching, liveness detection, and multi-layer fraud prevention in a single API call. Most verification providers give you OCR and a face match. Tuteliq cross-references every data source on the document against every other — MRZ check digits, barcode data, OCR text, front vs. back, document vs. selfie — and flags any inconsistency as potential tampering. This catches forgeries that pass single-layer checks.

Cross-device flow

Recommended integration path for mobile, web, and native apps. Create a session on your server, open the URL in a webview or QR code, get the result back via Server-Sent Events. Includes code samples for iOS (Swift), Android (Kotlin), React Native, Flutter, and web (iframe).

Age Verification

Confirm user age via document analysis, biometric estimation, or both. Direct-submission API for same-device flows.

Identity Verification

Full identity confirmation with document authentication, face matching, liveness detection, and fraud prevention.

Document Checks

45 countries with algorithmic validation. ICAO 9303 MRZ. PDF417 barcode decoding.

Fraud Prevention

7 cross-referencing layers, deterministic document validation, and IP geolocation checks.

What makes Tuteliq different

45-Country Document Validation

Algorithmic check digit validation for CPF, personnummer, Aadhaar, Codice Fiscale, CURP, SSN, and 39 more. Not just format checks — full mathematical verification.

7-Layer Cross-Referencing

MRZ vs. OCR. Barcode vs. OCR. Front vs. back. Document vs. selfie. Declared type vs. detected type. IP vs. document country. OCR confidence gating. Every inconsistency is flagged.

No Image Ever Reaches a Model

Document validation is deterministic: ICAO 9303 check digits, PDF417/AAMVA decoding, and field cross-referencing. Age comes from our own model on our own infrastructure. No identity document or selfie is sent to a language model.

Tier availability

Feature	Minimum Tier	Credits
Age Verification (liveness only)	Assure ($499/mo)	10 per verification
Age Verification (full)	Assure ($499/mo)	20 per verification
Identity Verification	Assure ($499/mo)	25 per verification

Age Verification

POST /api/v1/verify/age/submit Verify a user’s age through document analysis, biometric age estimation, or both. Returns a verified age range, confidence score, and detailed document intelligence.

Verification methods

Method	How it works	Best for
Document	Extracts DOB from government ID via OCR, MRZ parsing, and barcode decoding	High-assurance age gates, parental consent
Biometric	Estimates age from a selfie using AgeNet, our own model, run on our infrastructure (child/teen/adult classification)	Frictionless age checks, onboarding flows
Combined	Document + biometric with cross-reference — flags age inconsistencies > 10 years	Maximum assurance — verifies the document belongs to the person

Request

const result = await tuteliq.verifyAge({
  document: fs.createReadStream('id-front.jpg'),     // Government-issued ID
  documentBack: fs.createReadStream('id-back.jpg'),  // Optional — enables barcode reading + back cross-ref
  selfie: fs.createReadStream('selfie.jpg'),          // Optional — for biometric estimation
  method: 'combined',                                  // 'document' | 'biometric' | 'combined'
});

console.log(result.verified);        // true
console.log(result.estimated_age);   // 15
console.log(result.age_range);       // "13-15"
console.log(result.is_minor);        // true
console.log(result.confidence);      // 0.97
console.log(result.document_type);   // "passport"

result = client.verify_age(
    document=open("id-front.jpg", "rb"),
    document_back=open("id-back.jpg", "rb"),  # Optional
    selfie=open("selfie.jpg", "rb"),
    method="combined",
)

print(result.verified)        # True
print(result.estimated_age)   # 15
print(result.age_range)       # "13-15"
print(result.is_minor)        # True

curl -X POST https://api.tuteliq.ai/api/v1/verify/age/submit \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -F "document=@id-front.jpg" \
  -F "document_back=@id-back.jpg" \
  -F "selfie=@selfie.jpg" \
  -F "method=combined"

Response

{
  "verified": true,
  "estimated_age": 15,
  "age_range": "13-15",
  "is_minor": true,
  "confidence": 0.97,
  "method": "combined",
  "document_type": "passport",
  "document_country": "GB",
  "biometric_age": 15,
  "document_age": 15,
  "document": {
    "ocr_confidence": 94,
    "mrz_valid": true,
    "document_number_valid": true,
    "expired": false
  },
  "credits_used": 20
}

Response fields

Field	Type	Description
`verified`	boolean	Whether age verification succeeded
`estimated_age`	integer	Best estimate of user’s age
`age_range`	string	Tuteliq age bracket: `under-10`, `10-12`, `13-15`, or `14-17`
`is_minor`	boolean	Whether the user is under 18
`confidence`	float	Confidence score (0.0-1.0)
`method`	string	Method used: `document`, `biometric`, or `combined`
`document_type`	string	Detected document type
`document_country`	string	ISO 3166-1 alpha-2 country code
`biometric_age`	integer	Age estimated from selfie (if provided)
`document_age`	integer	Age from document DOB (if provided)
`document.ocr_confidence`	integer	OCR confidence percentage (0-100)
`document.mrz_valid`	boolean	Whether MRZ check digits passed (if MRZ present)
`document.document_number_valid`	boolean	Whether document number passed algorithmic validation
`document.expired`	boolean	Whether the document has expired
`credits_used`	integer	Credits consumed

Age extraction sources

DOB is extracted from multiple sources and cross-referenced. Priority order:

MRZ (Machine Readable Zone) — Most reliable. ICAO 9303 check digit validated.
PDF417 barcode — US/Canadian driver’s licenses. AAMVA-encoded structured data.
OCR labels — Text patterns like “Date of Birth:”, “DOB:”, date formats.
Selfie estimation — AgeNet, our own convolutional age-estimation model, run on our infrastructure (fallback). No LLM and no third-party vision API touches a verification image.

When multiple sources disagree, the verification flags the inconsistency.

Supported documents

Document Type	Coverage
Passport	All ICAO-compliant passports worldwide (MRZ validated)
National ID card	All countries with MRZ-equipped cards + 45 countries with document number validation
Driver’s license	All countries via OCR + US/Canada via PDF417 barcode
Residence permit	Via OCR text extraction

Documents must be a clear, well-lit photo in JPEG or PNG format. Maximum file size: 10MB.

Identity Verification

POST /api/v1/verify/identity/submit Full KYC identity verification combining document authentication, face matching, liveness detection, and country-specific national-ID validation. Assure plan and above.

What it checks

Every identity verification runs all of these checks automatically:

Check	What it does
Document OCR	Multilingual text extraction (Tesseract sidecar with multi-pass MRZ-tolerance pipeline)
MRZ validation	ICAO 9303 TD1/TD2/TD3 check-digit validation via `mrz` + `mrz-fast` libraries
Document number validation	Algorithmic check-digit verification for 45 countries (personnummer, CPF, Aadhaar, CURP, BSN, NIF, NINO, etc.)
Face detection + matching	`@vladmandic/face-api` model in dedicated sidecar; vector-distance match between document portrait and selfie
Liveness	Multi-signal: landmark motion, blink, texture/moiré, depth cues, cross-frame consistency, single-use cryptographic challenge token
Synthetic / deepfake detection	CLIP-based classifier (`deep-image-analysis` sidecar) on the selfie
Document expiry	Checks expiry from labels and MRZ
Country resolution	Inferred from MRZ issuing state, OCR text, or explicit `country_code` parameter

Request

cURL

curl -X POST https://api.tuteliq.ai/api/v1/verify/identity/submit \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -F "id_front=@id-front.jpg" \
  -F "id_back=@id-back.jpg" \
  -F "selfie=@selfie.jpg" \
  -F "liveness_token=YOUR_LIVENESS_TOKEN" \
  -F "document_type=passport"

Pass passport=@passport.jpg instead of id_front/id_back when verifying a passport. The liveness_token is issued by the liveness challenge step (see Liveness detection doc).

Response

{
  "verification_id": "string",
  "status": "verified",
  "full_name": "string",
  "first_name": "string",
  "last_name": "string",
  "date_of_birth": "string (ISO 8601)",
  "document_type": "passport",
  "country_code": "SWE",
  "country_name": "Sweden",
  "document_number": "string",
  "document_number_valid": true,
  "sex": "M",
  "nationality": "string",
  "place_of_birth": "string",
  "height_cm": 0,
  "issuing_authority": "string",
  "issue_date": "string (ISO 8601)",
  "expiration_date": "string (ISO 8601)",
  "national_id": {
    "value": "string",
    "valid": true,
    "type": "personnummer",
    "country_code": "SWE"
  },
  "mrz_valid": true,
  "liveness": { "valid": true, "reason": "string" },
  "face_match": { "matched": true, "distance": 0.0, "confidence": 0.0 },
  "credits_used": 0
}

All identity fields are null when not extractable (e.g. height_cm for national ID cards that don’t print height, or national_id for countries without a per-country extractor in this release).

Response fields

Field	Type	Description
`verification_id`	string \| null	Persistent ID for the record
`status`	string	`verified` \| `failed` \| `needs_review`
`full_name`	string \| null	Combined name as extracted from the document
`first_name`	string \| null	Given names — prefers MRZ-parsed, falls back to heuristic split
`last_name`	string \| null	Surname — same source preference
`date_of_birth`	string \| null	ISO 8601
`document_type`	string \| null	`passport` \| `national_id` \| `drivers_license`
`country_code`	string \| null	ISO 3166-1 alpha-3
`country_name`	string \| null	English country name
`document_number`	string \| null	Document number as printed / MRZ-parsed
`document_number_valid`	boolean \| null	Country-specific algorithmic validation passed
`sex`	string \| null	`M` \| `F`
`nationality`	string \| null	Text-extracted; MRZ fallback when available
`place_of_birth`	string \| null	As printed on the document
`height_cm`	integer \| null	Height in cm (range 50–250) when printed on the document
`issuing_authority`	string \| null	Issuing body (e.g. `POLISMYNDIGHETEN` for Swedish passports)
`issue_date`	string \| null	ISO 8601, when printed
`expiration_date`	string \| null	ISO 8601
`national_id`	object \| null	Country-specific personal/national ID (see below)
`mrz_valid`	boolean \| null	ICAO 9303 check digits all passed (null if no MRZ on the document)
`liveness`	object	`{ valid: boolean, reason?: string }`
`face_match`	object \| null	`{ matched: boolean, distance: number, confidence: number }`
`credits_used`	integer	Credits consumed

`national_id` object

Returned only when the document’s country has a per-country extractor in this release.

Field	Type	Description
`value`	string	The ID number as printed (with separator preserved when present)
`valid`	boolean	Country-specific algorithmic validation passed
`type`	string	Canonical name — `personnummer` (SWE), `fødselsnummer` (NOR), `henkilötunnus` (FIN), `DNI/NIE` (ESP), `CPF` (BRA)
`country_code`	string	ISO 3166-1 alpha-3

Countries with validators but no extractor yet (returns null for national_id until extractors land): DEU, FRA, ITA, NLD, GBR, IRL, CHE, AUT, CZE, ROU, HRV, BGR, GRC, HUN, EST, LVA, LTU, ARG, MEX, CHL, COL, PER, ECU, URY, CAN, USA, JPN, KOR, ZAF, THA, TUR.

Verification outcomes

Status	Meaning	Examples
`verified`	All checks passed	Valid document, face match, liveness passed
`failed`	Hard failure — definitive fraud signal	Liveness failed, face mismatch, document expired
`needs_review`	Soft failure — human review recommended	Low OCR confidence, low face-match confidence, partial field extraction

Integration patterns

// 1. Verify age during sign-up
const verification = await tuteliq.verifyAge({
  selfie: selfieStream,
  method: 'biometric',
});

// 2. Store the verified age group
const ageGroup = verification.age_range;  // "13-15"

// 3. Use verified age group in all safety calls
const safety = await tuteliq.detectUnsafe({
  text: messageContent,
  ageGroup: ageGroup,  // Properly calibrated risk scoring
});

// 1. Verify child's age
const childAge = await tuteliq.verifyAge({
  selfie: childSelfieStream,
  method: 'biometric',
});

if (childAge.estimated_age < 13) {
  // 2. Verify parent's identity
  const parent = await tuteliq.verifyIdentity({
    document: parentIdStream,
    selfie: parentSelfieStream,
  });

  if (parent.verified && !parent.is_minor) {
    await grantParentalConsent(childUserId, parent);
  }
}

Moderator/admin verification

const identity = await tuteliq.verifyIdentity({
  document: documentStream,
  selfie: selfieStream,
});

if (identity.verified && !identity.is_minor) {
  await grantModeratorRole(userId);
}

Verification plans with a monthly allowance

Some plans are sold as a monthly verification allowance, with verification packs you can buy on top. On these plans:

The allowance is a hard limit. Each month the included verifications are used first, then purchased packs, oldest first. Packs carry over from month to month and do not expire. Once both are used, new verifications are refused until the next period starts or more are bought; nothing is billed as overage.
The check happens when a verification starts: when a cross-device session is created, and on the direct submit routes. A refused request does no verification work and is not counted. Sandbox keys count toward the allowance like any other key.
The period is a calendar month in the plan’s timezone.
Usage stays readable. GET requests to /api/v1/usage/* are available on these plans. /api/v1/usage/monthly adds a verification object for the current period:

Field	Type	Description
`period`	string	The current period, as `YYYY-MM`.
`usage_timezone`	string	The timezone the period is counted in.
`next_period_start`	string	When the next period begins.
`included_per_month`	number	Verifications included each month.
`included_used`	number	Included verifications used this period.
`pack_used`	number	Verifications taken from packs this period.
`packs_remaining`	number	Verifications left across all purchased packs.
`remaining`	number	Verifications left this period, included and packs together.
`limit_reached`	boolean	`true` when nothing is left.
`total`	number	Verifications completed this period.
`in_progress`	number	Verifications started and not finished yet. They count against the allowance.
`sandbox_count`	number	Verifications this period made with sandbox keys.
`by_key`	object	Completed and sandbox counts per API key.

Endpoints outside verification and usage return 403 with SUB_7006 on these plans.

Redirect URLs must use https

The redirect URL a user returns to after a hosted verification is set in the dashboard, for the account or per API key. It must use https. If it does not, creating a verification session is refused with VERIFY_11011 (403), and the message says which setting to update.

Error handling

Verification errors use the VERIFY_11xxx code range:

Code	HTTP	Description
`VERIFY_11001` `VERIFY_OCR_FAILED`	500	OCR could not extract text from the document — retake under better lighting / less glare
`VERIFY_11002` `VERIFY_NO_DOB_FOUND`	400	Date of birth could not be extracted — try a clearer page / different document
`VERIFY_11003` `VERIFY_FACE_NOT_DETECTED`	400	No face detected in the selfie or document portrait
`VERIFY_11004` `VERIFY_FACE_MISMATCH`	400	Selfie does not match the document portrait
`VERIFY_11005` `VERIFY_LIVENESS_FAILED`	400	Liveness check failed — possible spoofing or stale capture
`VERIFY_11006` `VERIFY_SESSION_NOT_FOUND`	404	Session ID unknown — recreate the session
`VERIFY_11007` `VERIFY_SESSION_EXPIRED`	410	Session past TTL — recreate the session
`VERIFY_11008` `VERIFY_SESSION_INVALID_TOKEN`	401	Session token invalid — recreate the session, do not replay
`VERIFY_11009` `VERIFY_SESSION_ALREADY_USED`	409	Session token already consumed
`VERIFY_11010` `VERIFY_SESSION_WRONG_STATE`	409	Session not in the right state for this call
`VERIFY_11011` `VERIFY_NOT_ENABLED`	403	Verification not provisioned for this account, or the configured redirect URL does not use `https`
`VERIFY_11012` `VERIFY_IDENTITY_NOT_ENABLED`	403	Identity mode requires the Assure plan or above
`VERIFY_11013` `VERIFY_NO_COUNTRY_FOUND`	400	Country could not be inferred — pass `country_code` explicitly
`VERIFY_11014`	402	The monthly verification allowance, including purchased packs, is used up. `details` gives `period`, `next_period_start` and `buy_credits_url`. See above
`VERIFY_11015`	503	The allowance could not be checked. Temporary: retry after the `Retry-After` interval

cURL example error response

{
  "error": {
    "code": "VERIFY_11005",
    "message": "Liveness check failed",
    "request_id": "req_...",
    "retryable": false,
    "status_url": "https://tuteliq.ai/status",
    "documentation_url": "https://tuteliq.ai/docs/errors#VERIFY_11005"
  }
}

Data handling

Verification involves sensitive personal data. Tuteliq processes documents and selfies in real time and does not store images or extracted PII after the verification is complete. Only the verification result (age range, pass/fail) is retained. See the GDPR page for data handling details.

Next steps

Document Checks

Deep dive into 45-country document validation, MRZ parsing, and barcode reading.

Liveness Detection

How visual liveness analysis prevents spoofing attacks.

Fraud Prevention

Multi-layer cross-referencing, MRZ check-digit validation, and geographic consistency checks.

Cross-device flow

Age Verification

Identity Verification

Document Checks

Fraud Prevention

​What makes Tuteliq different

45-Country Document Validation

7-Layer Cross-Referencing

No Image Ever Reaches a Model

​Tier availability

​Age Verification

​Verification methods

​Request

​Response

​Response fields

​Age extraction sources

​Supported documents

​Identity Verification

​What it checks

​Request

​Response

​Response fields

​national_id object

​Verification outcomes

​Integration patterns

​Age gate on sign-up

​Parental consent flow (COPPA)

​Moderator/admin verification

​Verification plans with a monthly allowance

​Redirect URLs must use https

​Error handling

​Data handling

​Next steps

Document Checks

Liveness Detection

Fraud Prevention

What makes Tuteliq different

Tier availability

Age Verification

Verification methods

Request

Response

Response fields

Age extraction sources

Supported documents

Identity Verification

What it checks

Request

Response

Response fields

`national_id` object

Verification outcomes

Integration patterns

Age gate on sign-up

Parental consent flow (COPPA)

Moderator/admin verification

Verification plans with a monthly allowance

Redirect URLs must use https

Error handling

Data handling

Next steps