Introduction

FaceCard is face sign-in for your app. A user enrolls once with their email and a short camera capture. After that, they sign in by looking at the camera. No password is involved.

What FaceCard stores

FaceCard stores embeddings only. The browser SDK runs a face model on the user's device and turns the camera frames into a list of 128 numbers (a descriptor). Only those numbers leave the browser. No face image or video is uploaded, and none is stored anywhere. See Security and privacy for the full data and retention schedule.

How it works

1. Your page loads the browser SDK with a publishable key. The key only works from the origins you allow.
2. For every enroll or sign-in, the SDK asks the API for a single-use challenge, captures frames, and computes descriptors in the browser.
3. The API compares the descriptors with the templates enrolled in your app only and returns a user token (a signed JWT that lasts one hour) when they match.
4. Your server verifies the token, either online with POST /v1/tokens/verify or offline with the public keys at /.well-known/jwks.json, and starts its own session.

Browser (publishable key)        api.facecard.dev            Your server (secret key)
  challenge, descriptors  --->   match inside your app
  <--- user token (ES256 JWT)
  send token to your server  --------------------------->   verify token, create session

Honest limits

• Liveness checks run in the browser and are advisory. They raise the bar for casual spoofing but they are not a guarantee against a determined attacker. Read Liveness is advisory before you decide what FaceCard should protect.
• Matching uses a distance threshold and a margin between the best and second best candidate. A face that is not clear enough returns no_match, and the user can try again.
• FaceCard identifies a user inside one app. Users are never shared across apps.

Where to go next

Hosts

The machine readable API description is at https://api.facecard.dev/openapi.json. This site also publishes llms.txt and llms-full.txt for AI tools.