# SpoofSense ## Docs - [SpoofSense: Face Liveness & Deepfake Detection API](https://docs.spoofsense.ai/index.md): SpoofSense detects presentation attacks and AI-generated deepfakes in real time. One API call returns a calibrated score and a pass/fail decision. - [SpoofSense Quickstart: Liveness Check in 5 Minutes](https://docs.spoofsense.ai/quickstart.md): Make your first face liveness API call with SpoofSense. Get an API key, POST an image, and get a calibrated real/spoof decision back in seconds. - [How SpoofSense API Authentication Works: Keys & Tokens](https://docs.spoofsense.ai/guides/authentication.md): Learn how SpoofSense secret keys and short-lived session tokens work, when to use each, and how to keep credentials secure in your integration. - [SpoofSense Image Input Formats: File, Base64, URL, and Bytes](https://docs.spoofsense.ai/guides/image-inputs.md): Accepted image formats, size limits, orientation, and threshold overrides for all SpoofSense liveness and deepfake detection endpoints. - [Understanding SpoofSense Scores and Decision Thresholds](https://docs.spoofsense.ai/guides/thresholds.md): How calibrated scores work, how the decision threshold is resolved, and guidance for tuning liveness and deepfake detection accuracy. - [SpoofSense Credits and Billing: Costs and Balance Rules](https://docs.spoofsense.ai/guides/credits.md): Credit costs per detection type, balance deduction rules, zero-balance behavior, and how verification sessions handle pre-checks and free retries. - [SpoofSense API Errors: Codes, Statuses, and Handling](https://docs.spoofsense.ai/guides/errors.md): Complete reference for all SpoofSense error codes, HTTP statuses, meanings, and recommended handling for detection and verification session endpoints. - [Verification Sessions: Server-Side Secure Capture Flow](https://docs.spoofsense.ai/verification-sessions/overview.md): Verification sessions move camera capture into a trusted SDK, keeping scores and decisions server-side. Integrate for KYC, onboarding, or step-up auth. - [Web SDK: Browser Camera Capture for Live Verification](https://docs.spoofsense.ai/verification-sessions/web.md): Add face liveness capture to any website using the SpoofSense React component or vanilla JS SDK. Captures from the live camera with injection protection. - [Android SDK: Native Camera Capture for Verification](https://docs.spoofsense.ai/verification-sessions/android.md): Integrate SpoofSense face liveness verification into Android apps using CameraX and Play Integrity signals. Distributed via JitPack. - [Hosted Verify Page: Zero-Code Liveness Integration](https://docs.spoofsense.ai/verification-sessions/hosted.md): Redirect users to the SpoofSense hosted capture page or embed it in an iframe — no frontend SDK required. Uses the same capture flow as the Web SDK. - [Read Verification Results and Retrieve the Captured Selfie](https://docs.spoofsense.ai/verification-sessions/results.md): Read the verification decision and retrieve the captured selfie from your backend using the secret key. Covers the risk object and media access. - [Face liveness check](https://docs.spoofsense.ai/api-reference/detection/face-liveness-check.md): Checks whether the face in the image is a live capture rather than a presentation attack (printed photo, screen replay, mask). Costs 1 credit. - [Deepfake check](https://docs.spoofsense.ai/api-reference/detection/deepfake-check.md): Checks whether the face in the image is AI-generated or face-swapped. Costs 2 credits. Send the original capture — do not downscale or re-encode; resolution is load-bearing for this model. - [Liveness + deepfake in one call](https://docs.spoofsense.ai/api-reference/detection/liveness-+-deepfake-in-one-call.md): Runs both checks on the same image. The overall `decision` is `real` only when every check passes its threshold; per-product outcomes are in `checks`. Costs 3 credits. - [Create a verification session](https://docs.spoofsense.ai/api-reference/verification-sessions/create-a-verification-session.md): Called from your backend with the secret key. Mints a single-use `sst_` client token — returned exactly once, only its hash is stored. Products and thresholds are fixed here, server-side; the client can never change them. Fails fast with 402 if your balance is empty, so you never hand out a doomed t… - [Peek at a session (client token)](https://docs.spoofsense.ai/api-reference/verification-sessions/peek-at-a-session-client-token.md): Called by the SDK at mount, authenticated with the `sst_` client token. Returns the session's nonce (required in the submit payload) and status, so an expired or used session fails fast before the camera opens. - [Submit a capture (client token)](https://docs.spoofsense.ai/api-reference/verification-sessions/submit-a-capture-client-token.md): Called by the SDK with the `sst_` client token. Multipart only — no URLs, no raw bodies, no threshold overrides. The response is deliberately minimal: the untrusted client never sees scores or the decision. 3 attempts per session; capture-fault errors (413, 422, NONCE_MISMATCH) consume an attempt, s… - [Retrieve a session's result](https://docs.spoofsense.ai/api-reference/verification-sessions/retrieve-a-sessions-result.md): Called from your backend with the secret key. The only trustworthy read of the decision — treat the user as verified only when `status` is `complete` AND `decision` is `real`. When a capture was blocked for suspected injection, `checks` is null and `risk` carries only `{injection_blocked: true, reas… - [Retrieve the captured selfie](https://docs.spoofsense.ai/api-reference/verification-sessions/retrieve-the-captured-selfie.md): Called from your backend with the secret key — the sst_ client token can never reach this endpoint. Mints a signed URL to the exact bytes the models scored, valid for 5 minutes; fetch immediately rather than storing the link. Verify the download against `sha256`. Every retrieval is written to your o… - [Health check](https://docs.spoofsense.ai/api-reference/service/health-check.md) ## OpenAPI Specs - [openapi](https://docs.spoofsense.ai/api-reference/openapi.json)