Human Token

Markdown

With just a photo of the face, you turn your user into a unique human. Simple, intuitive and secure.

One human. One token. Always. Human Token creates a unique identity for each face from a single selfie, with no government-issued document required. This is useful both where that relationship does not exist and where your customers prefer not to share document numbers. Whenever you need to, request a new verification and compare the tokens: matching tokens mean the same human.

This allows you to:

• Detect recurring users and prevent duplicate accounts: one face, one token. Identify duplicate or fake accounts at sign-up, login and recovery, without official documents.
• Integrate via Web, Native, or API: using only the selfie image as input, with no additional document data required.
• Combine with other signals: add Human Token alongside other capabilities as needed.

Among the most common scenarios are deepfake attacks (confirming there is a real, present person behind every action, without CAPTCHA and without SMS), multiple accounts, promotion and referral abuse, password recovery, new device authentication and default reduction. Check the risk before the decision, not after the loss.

What it does

From the captured selfie, Human Token generates a stable, opaque biometric identifier (humanToken) that uniquely represents that face. The user does not declare any identifier — identity is the output of the call, not the input. On every successful match, the response returns the same humanToken, allowing the same user to be recognized in future processes, on any device or session.

Privacy by Design: no prior data is required, and the face photo can be discarded after processing: what stays in your system is the token, not the face — materially reducing the biometric exposure of your company and your customers.

Inputs

The only input is the selfie. With the API Only flows, your back-end sends it as imageBase64 in the body of Create Process. With the Human Token Journey flow (humantoken), the selfie is captured in the journey.

SDK required for quality capture

To ensure the image sent via API meets biometric requirements, use the Unico SDK for your platform or follow the Capture Standard. Human Token does not accept arbitrary images without capture quality control.

Possible responses

The result comes in data.humanToken: value is the identifier, and state tells where the process is — PROCESS_STATE_FINISHED when the result is ready. See Create Process › Interpreting the result.

When no humanToken can be generated

There is a single scenario in which Human Token does not produce a humanToken: the face cannot be identified in the submitted image — no face is detected, the image quality is too low, or the face is outside the capture standard (tilted, turned to the side). Following the Capture Standard is what prevents it.

humanToken is a stable, opaque identifier — the same user always resolves to the same value. Store it alongside your user record to recognize the same person on subsequent Human Token calls.

API integration

Human Token runs on the Human API. Your back-end creates the process with Create Process: with an API Only flow (api+humantoken, api+liveness+humantoken or api+liveness+humantoken+revalidation), the humanToken comes back in the same response; with the Human Token Journey flow (humantoken or humantoken+revalidation), the user goes through the journey and your back-end fetches the result with Get Process.

To get started:

1. Set up Authentication — every call sends your access key in the x-unico-accesskey header.
2. Create the process with Create Process and read data.humanToken.
3. Fetch the process again, when you need to, with Get Process.

Availability

Integration components required
API Web