Changelog

4.0.0 (2026-10-14)

The FaceCard relaunch: a new API and a new SDK.

API v1

• New public API at https://api.facecard.dev/v1, described by OpenAPI 3.1 at /openapi.json.
• Secret keys (fc_sk_live_...) for servers and publishable keys (fc_pk_live_...) for browsers, restricted by an Origin allow list.
• Single-use challenges (60 second lifetime) required for every enroll and match.
• Matching on the API with a cosine distance threshold and a margin between the best and second best user.
• ES256 user tokens (one hour) with public keys at /.well-known/jwks.json.
• POST /v1/me/logout revokes the user token (a jti denylist). Revoked tokens get 401 token_revoked, and POST /v1/tokens/verify returns reason: "revoked". Offline JWKS verification cannot see revocation.
• Consent is required to enroll. Users can delete themselves with DELETE /v1/me.
• Plans: Free, Pro and Enterprise with per-team monthly auth limits and per-IP and per-key rate limits.
• Retention schedule: biometric data deleted on account or app deletion or after 3 years without sign in; auth events after 400 days.

SDK @facecard/sdk 4.0

• createFaceCard({ publishableKey }) with enroll({ email, name, consent }) and signIn().
• createFaceCardServer({ secretKey }) with users.list, users.get, users.delete, tokens.verify, usage(month) and verifyTokenOffline(token).
• React: FaceCardProvider and useFaceCard.
• signOut() on the browser client: best effort POST /v1/me/logout, then always clears the stored token. It never throws.
• FaceCardError with code and status.

Breaking changes

• The previous SDK package is replaced by @facecard/sdk. See Migration.
• Old fs_live keys are gone. Create new keys in the portal.
• Users of the previous service must enroll again.