Skip to main content
This guide walks you through making your first liveness check and deepfake check with SpoofSense. In four steps you’ll create an account, obtain an API key, call the detection endpoint with a real image, and understand every field in the response. By the end you’ll also know how to switch to deepfake-only or unified detection with a single URL change.
1

Get an API Key

Sign in at app.spoofsense.ai and create a key under Dashboard → API keys. Keys look like sk_live_… and are shown once — SpoofSense stores only a hash, so copy your key before closing the dialog.Export it as an environment variable so the examples below work without modification:
The secret key must only ever live on your server. Never ship it in a browser bundle, a mobile app binary, or a public repository — doing so allows anyone who finds it to consume your credits.
2

Run a Liveness Check

Send any face image to the liveness endpoint — as a multipart file upload, a base64-encoded JSON body, or a publicly accessible URL. The examples below use a multipart file upload, which is the simplest approach for server-side code.
3

Read the Decision

A successful request returns a JSON object like this:
Response
Act on decision — it is either "real" or "spoof" and is the field your application logic should branch on. The remaining fields support tuning and audit:
  • genuine_score — the raw calibrated probability (0–1) that the face is genuine. Higher means more confident the image is real.
  • threshold — the value currently applied to produce the decision (genuine_score > threshold). The default is 0.5.
  • spoof_type — populated when decision is "spoof", describing the attack category detected (e.g. "printed_photo"). null when the check passes.
  • latency_ms — server-side processing time in milliseconds.
  • credits_remaining — how many detection credits remain on your account after this call.
  • session_id / request_id — use these when contacting support or correlating logs.
Use genuine_score and threshold together when you want to tune your acceptance rate. Raising the threshold makes the check stricter; lowering it makes it more permissive. See Thresholds & scores for a full guide.
4

Try Deepfake or Unified Detection

The request shape is identical — only the endpoint changes. To check for AI-generated or face-swapped imagery, call /v1/deepfake_detection. To run both liveness and deepfake checks in a single round trip, call /v1/unified_detection:
/v1/unified_detection runs both checks and returns decision: "real" only when every check passes. The response also includes a per-product checks object so you can see which individual check failed and by how much.

​
Next Steps

Verify Live Users with SDKs

For onboarding or KYC flows, use our Web and Android SDKs to capture the selfie directly from the camera with injection-attack protection — no image upload code required on your end.

Tune Thresholds

Learn how to raise or lower the decision threshold to balance your false-accept and false-reject rates for your specific risk tolerance.

Authentication Guide

Everything about API key scopes, rotation, and best practices for keeping your credentials secure.

API Reference

Every endpoint, parameter, and response field — with an interactive try-it console.