# Authenticate with biometrics using the Dashboard

The Face Authentication solution enables you to confirm that an applicant requesting to access new services or an existing account is the same person whose identity you've successfully verified.

The applicant captures a video of their face. Checkout.com compares the biometrics to a previous video of the applicant to check if they show the same person, and shares the result.

> **Information**
>
> To enable Face Authentication, contact your account manager or [request support](https://dashboard.checkout.com/support/new?topic=case_account_management_and_access&issue=issue_account_changes).

---

## Before you start

- You must have already integrated the [Identity Verification](https://www.checkout.com/docs/business-operations/manage-identities/verify-identities.md) solution and verified the applicant.
- The applicant must already have a [profile](https://www.checkout.com/docs/business-operations/manage-identities/manage-applicants.md) and an applicant ID, prefixed with `aplt_`.
- You must have a non-anonymized face video from a previous successful identity verification or face authentication available for the applicant.
- [Handle statuses, attempts, and response codes](https://www.checkout.com/docs/developer-resources/codes/identities-codes.md).
- [Subscribe to Face Authentication webhooks](https://www.checkout.com/docs/developer-resources/event-notifications/event-types.md#Face_Authentication).

### Configuration

When you request to enable Face Authentication, your account manager provides you a Face Authentication configuration ID, prefixed with `usj_`.
This is different to your [Identity Verification](https://www.checkout.com/docs/business-operations/manage-identities/verify-identities/using-the-api.md#Configuration) configuration ID.

You must provide the ID every time you create an authentication.
It configures the following elements of the solution:

- The service level agreement for receiving the result from Checkout.com
- How long to retain verification face videos to ensure you have one available for authentications
- Processing type:
    - Auto – Fully automated processing
    - Expert – Systematic human review

---

## How it works

1. [Retrieve the applicant ID](https://www.checkout.com/docs/business-operations/manage-identities/manage-applicants/using-the-dashboard.md#View_an_applicant_ID).
2. Create an authentication linked to the applicant's profile.
3. Create an attempt.
4. Redirect the applicant to the attempt.
5. View the authentication result.
6. If requested, you can remove the applicant's personal details from the authentication.

---

## Create an authentication

To create a face authentication, you need one of the following [user roles](https://www.checkout.com/docs/business-operations/use-the-dashboard/manage-users/user-permissions.md):

- Admin
- Identities manager
- A custom role with the `Process identities checks and manage configurations` permission

You can also create an initial attempt at the same time.

1. Sign in to the [Dashboard](https://dashboard.checkout.com/).
2. Go to _Identities_ > _Face authentication_.
3. Select _Create authentication_.
4. In the _Create authentication_ window, enter the applicant ID.
5. Select the configuration you want to apply to the authentication from the drop-down.
6. Select _Create authentication_.
7. In the _Create attempt_ window, provide the URL to redirect the applicant to after they complete the authentication. For example, your success or failure URL.
8. Select _Confirm_.

The authentication ID and the attempt URL are displayed, which you can copy if required.

If the authentication is created successfully:

- You receive an authentication ID, prefixed with `fav_`.
- The authentication status changes to `created`.
- You receive a [Face authentication created](https://www.checkout.com/docs/developer-resources/event-notifications/event-types/face-authentication-webhooks.md) webhook.

If the attempt is created successfully:

- You receive an attempt ID, prefixed with `fatp_`.
- You receive an attempt URL.
- The attempt status changes to `pending_redirection`.
- The authentication status changes to `pending`.
- You receive a [Face authentication opened](https://www.checkout.com/docs/developer-resources/event-notifications/event-types/face-authentication-webhooks.md) webhook.

---

## Create an attempt

To create a face authentication attempt, you need one of the following user roles:

- Admin
- Identities manager
- A custom role with the `Process identities checks and manage configurations` permission

1. Sign in to the [Dashboard](https://dashboard.checkout.com/).
2. Go to _Identities_ > _Face authentication_.
3. Search or filter for the authentication you want to create an attempt for, and select it.
4. On the _Authentication details_ page, select _Create attempt_.
5. In the _Create attempt_ window, provide the URL to redirect the applicant to after they complete the authentication. For example, your success or failure URL.
6. Select _Confirm_.<br>
The attempt ID and attempt URL are displayed, which you can copy if required.
7. Select _Done_.

On the _Authentication details_ page, the attempt appears under _Authentication_.

If the attempt is created successfully:

- You receive an attempt ID, prefixed with `fatp_`.
- You receive the attempt URL.
- The attempt status changes to `pending_redirection`.
- The authentication status changes to `pending`.
- You receive a [Face authentication opened](https://www.checkout.com/docs/developer-resources/event-notifications/event-types/face-authentication-webhooks.md) webhook.

---

## Redirect the applicant

Redirect the applicant to the attempt URL, which is valid for 15 minutes.

> **Note**
>
> If an attempt is unsuccessful and the applicant needs to retry, you can create new attempts.

**Successful attempt**

The following table describes the process of a successful attempt:

A successful attempt proceeds as follows:

| Step | Description |
| --- | --- |
| Applicant starts the attempt | The authentication and attempt statuses change to `capture_in_progress`.<br><br>You receive a [Face authentication started](https://www.checkout.com/docs/developer-resources/event-notifications/event-types/face-authentication-webhooks.md) webhook.<br><br>When successfully completed, the attempt status changes to `completed`.<br><br>You receive a [Face authentication capture completed](https://www.checkout.com/docs/developer-resources/event-notifications/event-types/face-authentication-webhooks.md) webhook. |
| Checkout.com processes the authentication | The authentication status changes to `checks_in_progress`.<br><br>When processing is complete, you receive a [Face authentication checks completed](https://www.checkout.com/docs/developer-resources/event-notifications/event-types/face-authentication-webhooks.md) webhook.<br><br>You may receive the checks completed webhook simultaneously with the capture completed webhook. |
| Result is available | The authentication status changes to either `approved` or `declined`.<br><br>If the applicant is declined, you can create a new authentication. |

**Unsuccessful attempt**

An attempt may be unsuccessful due to the following scenarios:

| Scenario | Description |
| --- | --- |
| Attempt URL expires | The attempt status changes to `expired`.<br><br>You receive a [Face authentication link expired](https://www.checkout.com/docs/developer-resources/event-notifications/event-types/face-authentication-webhooks.md) webhook.<br><br>Recommended action – Create a new attempt. |
| Applicant refuses the authentication | The authentication status changes to `refused`.<br><br>The attempt status changes to `capture_refused`.<br><br>You receive a [Face authentication capture refused](https://www.checkout.com/docs/developer-resources/event-notifications/event-types/face-authentication-webhooks.md) webhook.<br><br>Recommended action – Suggest an alternative authentication method to the applicant. |
| Applicant drops out of the attempt | The attempt status changes to `capture_aborted`.<br><br>You receive a [Face authentication capture aborted](https://www.checkout.com/docs/developer-resources/event-notifications/event-types/face-authentication-webhooks.md) webhook.<br><br>Recommended action – You can create a new attempt. |
| Applicant needs to retry | The authentication status changes to `retry_required`.<br><br>You receive a [Face authentication retry requested](https://www.checkout.com/docs/developer-resources/event-notifications/event-types/face-authentication-webhooks.md) webhook.<br><br>When you create a new attempt, the status of the previous attempt changes to `terminated`.<br><br>You receive a [Face authentication closed](https://www.checkout.com/docs/developer-resources/event-notifications/event-types/face-authentication-webhooks.md) webhook, followed by an [Face authentication reset](https://www.checkout.com/docs/developer-resources/event-notifications/event-types/face-authentication-webhooks.md) webhook.<br><br>Recommended action – Redirect the applicant to the new attempt URL. |
| Result is inconclusive | The authentication status changes to `inconclusive`.<br><br>The attempt status changes to `checks_inconclusive`.<br><br>You receive a [Face authentication checks inconclusive](https://www.checkout.com/docs/developer-resources/event-notifications/event-types/face-authentication-webhooks.md) webhook.<br><br>Recommended action – You can create a new attempt. |

> **Information**
>
> You can use the response codes returned in webhooks to implement your own business logic.
> Sharing guidance from response codes with the applicant can help the next attempt succeed. For example, if the applicant's data connection is poor, inform them so they can try to improve it.

### View attempts

To view a face authentication attempt, you need one of the following user roles:

- Admin
- Identities manager
- A custom role with the `View identities checks and data` or `Process identities checks and manage configurations` permission

1. Sign in to the [Dashboard](https://dashboard.checkout.com/).
2. Go to _Identities_ > _Face authentication_.
3. Search or filter for the authentication you want to view an attempt for, and select it.
4. On the _Authentication details_ page, all attempts appear under _Authentication_.

---

## View the authentication

You can view the face authentication at any time. For example, to check the status or details of an attempt.

When the result is available, it is displayed in the Dashboard.

You need one of the following user roles:

- Admin
- Identities manager
- A custom role with the `View identities checks and data` or `Process identities checks and manage configurations` permission

1. Sign in to the [Dashboard](https://dashboard.checkout.com/).
2. Go to _Identities_ > _Face authentication_.
3. Search or filter to find the authentication, and select it.

On the _Authentication details_ page, you can view the following information:

| Page section | Data |
| --- | --- |
| _Authentication details_<br><br>Always visible | - The authentication ID<br>- The authentication status<br>- Created – The date and time when the authentication was created.<br>- Last updated – The date and time when the authentication was last updated.<br>- Processing type – The processing type in your [configuration](https://www.checkout.com/docs/business-operations/manage-identities/verify-identities/using-the-api.md#Configuration). This can be `Auto` or `Expert`.<br>- Configuration ID |
| _Response codes_<br><br>Visible if the result is available | One or more response codes if the status is one of the following:<br><br>- `approved`<br>- `declined`<br>- `inconclusive`<br>- `pending`<br>- `refused`<br>- `retry_required` |
| _Risk codes_<br><br>Visible if the result is available | One or more [risk labels](https://www.checkout.com/docs/developer-resources/codes/identities-codes.md#Risk_labels) |
| _Captures_<br><br>Visible if the result is available | Face captures – Any images captured from the applicant's face video |
| _Applicant_<br><br>Always visible | - Applicant ID – The Checkout.com identifier for the applicant.<br>- Created – The date and time the applicant's profile was created.<br>- Last updated – The date and time the profile was last updated.<br>- Applicant email<br>- External applicant ID – Your identifier for the applicant.<br>- External applicant name – The name you have on record for the applicant.<br><br>To view the applicant's full details, select _View applicant profile_. |
| _Authentication_<br><br>Always visible | This can include the following:<br><br>- Applicant profile created<br>- Authentication created<br>- All webhook events<br>- All attempts<br>- Final authentication status |

### Audits

If the authentication is later audited and the status updated, you receive a [Face authentication audit completed](https://www.checkout.com/docs/developer-resources/event-notifications/event-types/face-authentication-webhooks.md) webhook.

---

## Remove personal details

If requested by an applicant under the General Data Protection Regulation (GDPR), you can remove the following personally identifiable information (PII) from the face authentication:

- External applicant name – The name you have on record for the applicant.
- Applicant email – The applicant's email address.

> **Note**
>
> Removing an applicant's PII is permanent. You cannot undo this action.
> Any information from the applicant's checks that is not linked to their personal identity is retained for your records.

You need one of the following user roles:

- Admin
- Identities manager
- A custom role with the `Process identities checks and manage configurations` permission

1. Sign in to the [Dashboard](https://dashboard.checkout.com/).
2. Go to _Identities_ > _Face authentication_.
3. Search or filter for the authentication you want to remove the PII for, and select it.
4. On the _Authentication details_ page, select _Remove personal details_. <br>
A warning that this action is permanent appears.
5. Select _Remove personal details_ to confirm the action.

On the _Authentication details_ page, you can see the date and time when the PII was removed.

You receive a [Face authentication anonymized](https://www.checkout.com/docs/developer-resources/event-notifications/event-types/face-authentication-webhooks.md) webhook.