UnifyID developer documentation

Build with one trusted identity layer

Authenticate people and request verified identity information without collecting documents, biometrics, or sensitive onboarding data inside your application.

UnifyID is an identity provider. A person maintains one verified identity account, while each application receives an isolated subject identifier and only the information that person approves. Your system never receives raw provider payloads, biometric templates, or complete identity records.

Choose an integration

Every option uses the same authorization, consent, policy-driven face assurance, and token boundaries. Choose based on how much interface control your team needs.

Recommended

Hosted UnifyID

Redirect to UnifyID and let us manage sign-in, account-bound face assurance, consent, and recovery.

Integrate hosted flow →

Embedded

UnifyID component

Add a branded control while keeping authentication and identity capture on the hosted security boundary.

Use the component →

Advanced

OAuth API

Construct authorization requests yourself when your team needs complete control over the interface and backend.

Build with the API →

Authorization lifecycle

01
Start authorization
Your application creates state, nonce, and PKCE values, then redirects the person to UnifyID.
02
Authenticate the account
UnifyID establishes the account session and completes configured authentication requirements.
03
Complete face assurance
When policy requires it, the person completes account-bound live-face assurance.
04
Approve requested data
The person reviews the purpose and chooses which requested information may be shared.
05
Exchange the code
Your backend exchanges the one-time code and requests only the approved identity information.

Platform capabilities

Capability	Purpose
Continue with UnifyID	Authenticate a verified person with Authorization Code and OpenID Connect.
Verified claims	Receive approved email, phone, legal identity, assurance, and profile information.
Verified documents	List document summaries and retrieve permitted fields by opaque reference.
Signed webhooks	Receive consent and claim-access lifecycle events with retry delivery.
Organization workspaces	Manage approved organizations, members, roles, invitations, and applications.
Native mobile SDKs	Integrate Android/Kotlin, Flutter, React Native, and iOS through native browser authorization and PKCE.

Privacy boundary

The same person receives a different pairwise sub in unrelated applications. Effective access is always the intersection of application configuration, request scopes, active user consent, verified data availability, and UnifyID policy.

Minimize data. Request age_over_18 instead of birth date when a threshold is enough, and document_number_masked instead of the complete number.