---
title: Human Token
description: Derives a stable, opaque humanToken from a selfie — identity is the output of the call, not the input. No identifier is declared by the user.
canonical: https://developer.unico.io/human-token/
locale: en
generated_by: markdown-export
---

- [/](/)
- Human Token

**On this pageHuman Token

With just a photo of the face, you turn your user into a unique human. Simple, intuitive and secure.
**One human. One token. Always.** Human Token creates a unique identity for each face from a single selfie, with no government-issued document required. This is useful both where that relationship does not exist and where your customers prefer not to share document numbers. Whenever you need to, request a new verification and compare the tokens: matching tokens mean the same human.
This allows you to:

**Detect recurring users and prevent duplicate accounts**: one face, one token. Identify duplicate or fake accounts at sign-up, login and recovery, without official documents.
**Integrate via Web, Native, or API**: using only the selfie image as input, with no additional document data required.
**Combine with other signals**: add Human Token alongside other capabilities as needed.

Among the most common scenarios are deepfake attacks (confirming there is a real, present person behind every action, without CAPTCHA and without SMS), multiple accounts, promotion and referral abuse, password recovery, new device authentication and default reduction. Check the risk before the decision, not after the loss.
### What it does​

From the captured selfie, Human Token generates a stable, opaque biometric identifier (`humanToken`) that uniquely represents that face. The user does not declare any identifier — identity is the output of the call, not the input. On every successful match, the response returns the same `humanToken`, allowing the same user to be recognized in future processes, on any device or session.
**Privacy by Design:** no prior data is required, and the face photo can be discarded after processing: what stays in your system is the token, not the face — materially reducing the biometric exposure of your company and your customers.
### Inputs​

The only input is the selfie. With the API Only flows, your back-end sends it as `imageBase64` in the body of [Create Process](/human-token/api-reference/post-processes). With the Human Token Journey flow (`humantoken`), the selfie is captured in the journey.
SDK required for quality captureTo ensure the image sent via API meets biometric requirements, use the [Unico SDK](/human-token/integrations) for your platform or follow the [Capture Standard](/human-token/additional-resources/capture-standard). Human Token does not accept arbitrary images without capture quality control.
### Possible responses​

The result comes in `data.humanToken`: `value` is the identifier, and `state` tells where the process is — `PROCESS_STATE_FINISHED` when the result is ready. See [Create Process › Interpreting the result](/human-token/api-reference/post-processes#interpreting-the-result).
When no `humanToken` can be generatedThere is a single scenario in which Human Token does not produce a `humanToken`: the face cannot be identified in the submitted image — no face is detected, the image quality is too low, or the face is outside the capture standard (tilted, turned to the side). Following the [Capture Standard](/human-token/additional-resources/capture-standard) is what prevents it.
`humanToken` is a stable, opaque identifier — the same user always resolves to the same value. Store it alongside your user record to recognize the same person on subsequent Human Token calls.
### API integration​

Human Token runs on the Human API. Your back-end creates the process with [Create Process](/human-token/api-reference/post-processes): with an API Only flow (`api+humantoken`, `api+liveness+humantoken` or `api+liveness+humantoken+revalidation`), the `humanToken` comes back in the same response; with the Human Token Journey flow (`humantoken` or `humantoken+revalidation`), the user goes through the journey and your back-end fetches the result with [Get Process](/human-token/api-reference/get-process).
To get started:

Set up [Authentication](/human-token/get-started/authentication) — every call sends your access key in the `x-unico-accesskey` header.
Create the process with [Create Process](/human-token/api-reference/post-processes) and read `data.humanToken`.
Fetch the process again, when you need to, with [Get Process](/human-token/api-reference/get-process).

### Availability​

Integration components requiredAPI WebLast updated on Oct 21, 2026**