Capture runs in the mobile browser; no app install is required. The flow:
They open the link
The start_url from your session, a hosted link or a verify button. The session moves to handed_off.
On a computer, the page shows a QR code. The code works once and lasts five minutes, and once a phone has opened it the session stays with that phone. Laptop webcams make poor ID photos, so capture always happens on a phone.
They agree to the check
We explain what we'll capture, why, and for how long it's kept, and ask for their agreement. We record when they agreed and which version of the wording they saw. The session moves to capturing.
They photograph their ID
A passport, or both sides of a driving licence. The camera guides them in real time: it finds the card's edges, and asks them to hold still, come closer, or tilt away from glare. It only takes the photo when the image is sharp, flat and fully in frame, so we rarely need to ask again.
They record a short selfie
They fit their face in an oval and follow two or three random prompts, such as turning their head or smiling. The prompts change every time, so a recording or a photo of someone else can't pass. We keep the short clip and a few still frames.
They're done
The session moves to submitted. If you set a redirect_url, they get a button back to your app.
link What we check
Checks run server-side after submission. Each check emits signals with a reason code and evidence.
| Check | Detects |
|---|---|
| Document | Inconsistent MRZ or printed data, layout and font anomalies, edited fields, and screen or print recaptures. |
| Liveness | Randomised prompts not completed in time, masks, screen replays and deepfakes. |
| Face match | A selfie that doesn't match the portrait on the ID. |
| Fraud memory | The same document, face or upload seen before, in your workspace or at another business that uses KayWhySee. A document or face with someone else's details is rejected. A person seen before under another of your references, or at another business, is flagged for review or only noted, as Settings → Fraud memory says. Another business is never named. |
Rolling out
The document's consistency checks run today: its MRZ, its dates and validity, and the licence number. Forensic, face and liveness checks are being added in stages. Until all of them are live, sessions stop at submitted and nothing is decided automatically.
link Client and server
The browser runs quality checks (sharpness, glare, framing) before upload to reduce retakes. All decisions are made server-side from the original captures; values reported by the device are not trusted.