Skip to main content

KYC/KYB verification API · Mozambique-first

Verify identities. One API, one hosted flow.

thibit reads an ID document, checks it's genuine, matches the selfie to the document photo, and returns a decision — over a simple API and a hosted page your users open on their phone. Engine-first, delivered over an API. Mozambican IDs and passports from anywhere.

Read the quickstart Talk to the team

create a verification

/v1 
POST https://api.thibit.id/v1/flows/default-kyc/intake
X-API-Key: tk_test_…

{
  "country": "MZ",
  "document_type": "auto",
  "verifiee": {
    "your_internal_id": "usr_998"
  }
}

Response

{
  "id": "ver_…",
  "status": "collecting",
  "onboarding_url": "https://onboard…/?token=…"
}

Two surfaces, one record

You create it. Your user completes it.

The developer decides what a verification accepts; the applicant just follows the link.

Integrator API

The /v1 API

Create a verification with the documents you accept, get a hosted onboarding_url, and receive the verdict by HMAC-signed webhook or by polling. Tenant-scoped API keys, self-serve sandbox.

Hosted onboarding

The mobile flow

Your user opens the link, picks one of the documents you allowed, photographs it, and takes a selfie. Mobile-first, in Portuguese, no thibit account. You only see the result.

Plus a developer dashboard: sign in with Google or GitHub to author a verification flow once in Build, activate it as a shareable hosted link in Flows, and review every run in Verifications — or run a flow straight from your backend by POSTing the data you already hold.

What it verifies

One engine. Document, authenticity, liveness.

Every check runs in one in-house engine — no per-vendor integrations to wire up or keep in sync.

Documents

Mozambican Bilhete de Identidade, Mexican INE, plus passports from ~any country via ICAO 9303 MRZ check-digits, edge-trim recovery, and per-country formats.

Authenticity

Vision-LLM document-authenticity check combined with metadata fingerprints flags edited, photoshopped, or re-captured images (screens/prints) automatically.

Liveness (4D)

Advanced 4D liveness capturing active movement (turn, nod, blink) plus dynamic screen illumination analysis to stop sophisticated masks and replays. Matched to the ID photo.

Match against your records

Verify the person matches your records — not just that the ID is real.

When you start a verification, send the person you already have on file — their name, date of birth, ID number. thibit compares what it reads off the document against your record and flags any divergence, so a genuine ID that belongs to someone else doesn't slip through.

Send your record

POST the name, DOB, and ID number you already hold when you run a flow. It pre-fills capture for your user, too.

Get a divergence flag

thibit reconciles collected vs claimed and names any name / DOB / number mismatch — a read-only signal next to the engine's decision.

How it works

Three calls from zero to a verdict.

1

Author

Compose a Flow from pre-built Capture, Check, and Decide pieces (like OCR, Liveness, and Metadata checks) in your dashboard.

2

Collect

Send the applicant to your Flow URL. They photograph their ID and complete 4D liveness on their phone. No app needed.

3

Review

The engine issues an advisory recommendation (pass / flag / fail) with deep evidence. Review borderline cases in the Case Management portal.

Status moves collecting → pending → processing → completed. See the quickstart for working curl.

Who it's for

Built for the developer who ships onboarding.

Developers

Get a sandbox key, a clear /v1 API, HMAC webhooks, and a hosted redirect — first integration in an afternoon. Sign in to a dashboard to manage projects and keys, author a flow once in Build, share its hosted link, and review every run in Verifications.

Read the docs →

Your users

A Mozambican with a BI, a foreign resident with a passport, a business representative — each opens a link and completes verification on their phone in minutes, with a clear path if a document is unreadable.

What thibit is — and isn't

Document & liveness verification. Nothing you didn't ask for.

Engine-only

One in-house verification engine — OCR, template match, document-authenticity, liveness — behind a clean API. No vendor orchestration to maintain.

Mozambique-first

Format-aware Mozambican ID templates, with global passport and national-ID coverage via ICAO MRZ so foreign residents verify too — expanding next across Lusophone Africa (Angola, Cabo Verde, Guiné-Bissau, São Tomé).

Compliance by webhook

Every verdict is delivered HMAC-signed and kept in a read-only verification log you can review.

Clear boundaries

thibit is not a sanctions/PEP/AML database, a fraud score, or an identity wallet. It verifies that a document is genuine and the person matches it — so you, the regulated party, can discharge your Lei nº 3/2017 KYC obligation.

Ship verification this week.

Grab a sandbox key, create your first verification, and open the hosted link on your phone. Free to start while we build — no local KYC API existed for Mozambique, so we built one.

Read the quickstart Talk to the team