# SpoofSense

> Face liveness and deepfake detection API

## Docs

- [Introduction](https://docs.spoofsense.ai/index.md): Face liveness and deepfake detection, behind one API
- [Quickstart](https://docs.spoofsense.ai/quickstart.md): Your first liveness check in five minutes
- [Authentication](https://docs.spoofsense.ai/guides/authentication.md): Secret keys and session tokens
- [Image inputs](https://docs.spoofsense.ai/guides/image-inputs.md): Every way to send an image to the detection endpoints
- [Thresholds & scores](https://docs.spoofsense.ai/guides/thresholds.md): How genuine_score and decision work, and when to tune the threshold
- [Credits & billing](https://docs.spoofsense.ai/guides/credits.md): What a call costs and how balances behave
- [Errors](https://docs.spoofsense.ai/guides/errors.md): Every error code, and what to do about it
- [How sessions work](https://docs.spoofsense.ai/verification-sessions/overview.md): The secure capture flow behind the SDKs and hosted page
- [Web SDK](https://docs.spoofsense.ai/verification-sessions/web.md): Camera capture for browsers — React, vanilla JS, or a script tag
- [Android SDK](https://docs.spoofsense.ai/verification-sessions/android.md): Native capture with CameraX and Play Integrity signals
- [Hosted verify page](https://docs.spoofsense.ai/verification-sessions/hosted.md): Zero frontend code — redirect or embed our capture page
- [Results & media](https://docs.spoofsense.ai/verification-sessions/results.md): Reading the decision and retrieving the captured selfie — server-side
- [Face liveness check](https://docs.spoofsense.ai/api-reference/detection/face-liveness-check.md): Checks whether the face in the image is a live capture rather than a presentation attack (printed photo, screen replay, mask). Costs 1 credit.
- [Deepfake check](https://docs.spoofsense.ai/api-reference/detection/deepfake-check.md): Checks whether the face in the image is AI-generated or face-swapped. Costs 2 credits. Send the original capture — do not downscale or re-encode; resolution is load-bearing for this model.
- [Liveness + deepfake in one call](https://docs.spoofsense.ai/api-reference/detection/liveness-+-deepfake-in-one-call.md): Runs both checks on the same image. The overall `decision` is `real` only when every check passes its threshold; per-product outcomes are in `checks`. Costs 3 credits.
- [Create a verification session](https://docs.spoofsense.ai/api-reference/verification-sessions/create-a-verification-session.md): Called from your backend with the secret key. Mints a single-use `sst_` client token — returned exactly once, only its hash is stored. Products and thresholds are fixed here, server-side; the client can never change them. Fails fast with 402 if your balance is empty, so you never hand out a doomed t…
- [Peek at a session (client token)](https://docs.spoofsense.ai/api-reference/verification-sessions/peek-at-a-session-client-token.md): Called by the SDK at mount, authenticated with the `sst_` client token. Returns the session's nonce (required in the submit payload) and status, so an expired or used session fails fast before the camera opens.
- [Submit a capture (client token)](https://docs.spoofsense.ai/api-reference/verification-sessions/submit-a-capture-client-token.md): Called by the SDK with the `sst_` client token. Multipart only — no URLs, no raw bodies, no threshold overrides. The response is deliberately minimal: the untrusted client never sees scores or the decision. 3 attempts per session; capture-fault errors (413, 422, NONCE_MISMATCH) consume an attempt, s…
- [Retrieve a session's result](https://docs.spoofsense.ai/api-reference/verification-sessions/retrieve-a-sessions-result.md): Called from your backend with the secret key. The only trustworthy read of the decision — treat the user as verified only when `status` is `complete` AND `decision` is `real`. When a capture was blocked for suspected injection, `checks` is null and `risk` carries only `{injection_blocked: true, reas…
- [Retrieve the captured selfie](https://docs.spoofsense.ai/api-reference/verification-sessions/retrieve-the-captured-selfie.md): Called from your backend with the secret key — the sst_ client token can never reach this endpoint. Mints a signed URL to the exact bytes the models scored, valid for 5 minutes; fetch immediately rather than storing the link. Verify the download against `sha256`. Every retrieval is written to your o…
- [Health check](https://docs.spoofsense.ai/api-reference/service/health-check.md)

## OpenAPI Specs

- [openapi](https://docs.spoofsense.ai/api-reference/openapi.json)