# FaceCard

> FaceCard adds face sign-in to your app. A browser SDK computes a face embedding (128 numbers) on the user's device, the API matches it against the users enrolled in your app only, and your server verifies a signed ES256 user token. FaceCard stores embeddings only, never face images. This documentation covers the quickstarts, concepts, the v1 REST API at https://api.facecard.dev, error codes, plans and limits, security and privacy, and the @facecard/sdk 4.0 package.

## Docs

- [Introduction](https://docs.facecard.dev/md/index.md): What FaceCard is, what it stores, and how face sign-in works.
- [Quickstart: browser](https://docs.facecard.dev/md/quickstart-browser.md): Enroll and sign in a user from a script tag or a React app.
- [Quickstart: server](https://docs.facecard.dev/md/quickstart-server.md): Verify user tokens and list users from Node with your secret key.
- [Concepts](https://docs.facecard.dev/md/concepts.md): The ideas behind FaceCard: apps, keys, tokens, challenges, matching and liveness.
- [Apps and keys](https://docs.facecard.dev/md/concepts/apps-and-keys.md): Apps are the isolation boundary. Secret keys are for servers, publishable keys are for allowed browser origins.
- [User tokens and JWKS](https://docs.facecard.dev/md/concepts/user-tokens.md): The signed ES256 token a successful enroll or match returns, and how to verify it.
- [Challenges and replay protection](https://docs.facecard.dev/md/concepts/challenges.md): Every enroll and match needs a fresh, single-use challenge that expires after 60 seconds.
- [Matching: threshold and margin](https://docs.facecard.dev/md/concepts/matching.md): How FaceCard compares a face with enrolled templates and when it answers no_match.
- [Liveness is advisory](https://docs.facecard.dev/md/concepts/liveness.md): The browser liveness check is a signal, not a guarantee. What it does and what it cannot do.
- [API reference](https://docs.facecard.dev/md/api-reference.md): Base URL, credentials, conventions and an index of every FaceCard v1 route.
- [POST /v1/challenges](https://docs.facecard.dev/md/api-reference/challenges.md): Request a single-use challenge before every enroll or match.
- [POST /v1/enroll](https://docs.facecard.dev/md/api-reference/enroll.md): Create a user with their email, name, face descriptors and consent.
- [POST /v1/match](https://docs.facecard.dev/md/api-reference/match.md): Sign a user in by matching face descriptors against the app's enrolled users.
- [/v1/me routes](https://docs.facecard.dev/md/api-reference/me.md): Let a signed-in user read, update and delete their own profile.
- [/v1/users routes](https://docs.facecard.dev/md/api-reference/users.md): List, read and delete the users of your app with a secret key.
- [POST /v1/tokens/verify](https://docs.facecard.dev/md/api-reference/tokens.md): Verify a user token from your server.
- [GET /v1/usage](https://docs.facecard.dev/md/api-reference/usage.md): Read monthly usage for your app.
- [Health, JWKS and OpenAPI](https://docs.facecard.dev/md/api-reference/meta-routes.md): The public routes that need no credential.
- [Errors](https://docs.facecard.dev/md/errors.md): The error format and every error code the FaceCard API returns.
- [Plans and limits](https://docs.facecard.dev/md/plans-and-limits.md): What each plan includes and the limits the API enforces.
- [Security and privacy](https://docs.facecard.dev/md/security-and-privacy.md): What FaceCard stores, how long, the consent requirement, and how deletion works.
- [SDK reference](https://docs.facecard.dev/md/sdk.md): @facecard/sdk 4.0: a browser client, a server client, React bindings and one error class.
- [Browser client](https://docs.facecard.dev/md/sdk/browser.md): createFaceCard, enroll and signIn.
- [Server client](https://docs.facecard.dev/md/sdk/server.md): createFaceCardServer with users, tokens, usage and offline verification.
- [React](https://docs.facecard.dev/md/sdk/react.md): FaceCardProvider and useFaceCard.
- [FaceCardError](https://docs.facecard.dev/md/sdk/errors.md): The error class every SDK call rejects with.
- [Migration from FaceSmash](https://docs.facecard.dev/md/migration.md): Move from @facesmash/sdk to @facecard/sdk 4.0.
- [Changelog](https://docs.facecard.dev/md/changelog.md): Release notes for the FaceCard API and the SDK.

## Optional

- [Full documentation in one file](https://docs.facecard.dev/llms-full.txt)
- [OpenAPI 3.1 description](https://api.facecard.dev/openapi.json)
- [Developer portal](https://developers.facecard.dev)