NFC verification
Read the chip in passports and ID cards and prove it is genuine.
The chip in an ePassport or eID holds the holder's data and photo, signed by the issuing country. Checking that signature is the strongest proof a document is real.
#What we verify (ICAO 9303 Passive Authentication)
- Each data group's hash matches the signed Document Security Object (SOD).
- The SOD signature is valid (RSA, RSA-PSS or ECDSA).
- The Document Signer certificate chains to the issuing country's CSCA certificate in our trust list.
- The chip's MRZ (DG1) matches the printed document, and its photo (DG2) matches the selfie.
#How to use it
NFC needs a native app. Use the reader in sdk/nfc/ (iOS and Android), then send the chip data with the session token:
/v1/flow/nfcWith a session token, from your app/v3/nfc/With a secret key, from your server#SDK
| Platform | Open-source library |
|---|---|
| Android 7+ | JMRTD and SCUBA (LGPL). Tries PACE, then BAC |
| iOS 15+ (iPhone 7 or later) | NFCPassportReader (MIT) |
The app reads the MRZ from the document photo, uses it to open the chip, and posts {sod, dg1, dg2} (base64) to POST /v1/flow/nfc. Browsers can't read passport chips, so this needs a native app.
#Trust list
Chips are only fully trusted when we hold the issuing country's CSCA certificate. Load the certificates in Admin → NFC trust list from the ICAO PKD master list or a national master list (for example the German BSI or Dutch RDW lists). Until a country's certificate is loaded, its chips come back verified_signature_only and go to review.
#Results
nfc:chip_data_not_authentic: declined.nfc:issuer_not_trusted,nfc:chip_photo_mismatch,nfc:name_differs_from_applicant,nfc:dob_differs_from_applicant: sent to review.
Active Authentication and Chip Authentication (clone detection) run on the phone and are reported in chip_authentication.