Veridexa is currently free for everyone — Fraud Detection, Biometrics, and Developer APIs.

NFC / eMRTD

Server-side eMRTD ingest with Passive & Active Authentication.

Live Engine

Engine

src/lib/verification/nfc-emrtd (ICAO 9303 PA/AA, pkijs, Web Crypto)

API

POST /api/public/emrtd/ingest

Because browsers can't speak ISO-DEP/APDU to an ICAO 9303 chip, chip reading happens on an external native client and the data groups are POSTed to Veridexa. The server verifies Passive Authentication (DG hashes against SOD, DSC signature via pkijs) and Active Authentication (challenge–response over RSA or ECDSA via Web Crypto), and parses the TD3 MRZ from DG1.

What is implemented

  • HMAC-SHA256 request-signature verification
  • Passive Authentication (DG1/DG2/DG3/DG7/DG11/DG12 vs SOD)
  • DSC signature validation via pkijs
  • Active Authentication (RSA + ECDSA) via Web Crypto
  • TD3 MRZ parser + TLV metadata extraction

Endpoint & modules

POST /api/public/emrtd/ingest

src/lib/verification/nfc-emrtd/
src/routes/api/public/emrtd/ingest.ts
biometric-core.api/v1 · isolated from Fraud Detection · mock adapters clearly labelled; certified providers register behind the same contracts.