Overview

Peabody Secure provides identity verification (KYC) and AML/sanctions screening as a hosted service.

The verification flow consists of three steps:

1. ID Upload — the user photographs the front and back of their driver's license. The back barcode is parsed automatically.
2. Liveness Check — the user completes a short challenge (blink, smile, etc.) captured via webcam.
3. Face Match — the selfie from the liveness check is compared to the photo on the ID. Sanctions screening runs automatically against the name on the ID.

You can embed this flow in your own site using the JS Widget, or drive it directly via the REST API.

Authentication

All protected endpoints are authenticated via an HttpOnly JWT cookie named jwt. The cookie is set automatically when a user logs in via POST /api/login.php and is sent by the browser on every subsequent request to the same domain.

There is no Authorization header — the cookie is the credential. This means your front-end does not need to manage tokens manually for same-domain use.

Obtaining a session

POST /api/login.php
Content-Type: application/json

{
  "email": "user@example.com",
  "password": "yourpassword"
}

On success the server sets the jwt cookie (1-hour expiry, HttpOnly, Secure, SameSite=Lax) and returns:

{ "message": "Login successful" }

Ending a session

GET /api/logout.php

Clears the jwt cookie and redirects to /login.html.

Embeddable JS Widget

The Peabody Secure widget is a self-contained JavaScript library that renders the full ID upload + liveness + face-match flow inside a modal overlay on your page. The user must already be logged in (JWT cookie present) before you call open().

1. Include the script

<script src="https://peabodysecure.com/js/peabody-widget.js"></script>

2. Initialize and open

PeabodySecure.init({
  baseUrl: 'https://peabodysecure.com',
  onSuccess: function(verificationId) {
    console.log('Verified! ID:', verificationId);
    // Send verificationId to your backend to record the result
  },
  onError: function(err) {
    console.error('Verification error:', err);
  }
});

// Launch the verification modal
PeabodySecure.open();

Widget options

Auth Endpoints

All endpoints are direct PHP files — there is no URL rewriting. Use the exact paths shown below.

{
  "name": "Jane Smith",
  "email": "jane@example.com",
  "password": "minimum8chars"
}

{
  "message": "Registration successful",
  "api_key": "a3f8c2..."
}

{
  "email": "jane@example.com",
  "password": "yourpassword"
}

{ "message": "Login successful" }

KYC Flow

The three-step verification flow. All endpoints require an active session (JWT cookie). Call them in order.

Step 1 — Upload ID images

front   (file)  Front of ID — JPEG, PNG, or PDF, max 10 MB
back    (file)  Back of ID  — JPEG, PNG, or PDF, max 10 MB

{
  "verification_id": "uuid-string"
}

Step 2 — Liveness check

{ "challenge": "Blink" }
// Possible values: "Blink", "Smile", "Look Left", "Look Right"

video      (file)    WebM video, ~3 seconds
challenge  (string)  The challenge string returned above

{
  "live": true,
  "selfie_frame": "base64-encoded-jpeg"
}

// On failure:
{ "live": false, "error": "Liveness check failed or challenge not detected." }

Step 3 — Face match & final result

verification_id  (string)  UUID from Step 1
selfie           (file)    JPEG selfie image (use selfie_frame from Step 2)
is_live          (string)  "1" if liveness passed, "0" otherwise

{
  "status":             "passed",       // "passed" | "pending_review" | "failed"
  "face_matched":       true,
  "is_live":            true,
  "score":              0.42,           // ArcFace cosine distance — lower = more similar
  "sanctions_status":   "clear",        // "clear" | "hit" | "skipped" | "error"
  "sanctions_hit_count": 0,
  "sanctions_name":     "JANE SMITH"   // Name screened (from ID barcode)
}

Mobile Camera Handoff

If a user is on a desktop and wants to use their phone camera to photograph the ID, generate a QR code linking to a mobile session. The desktop page polls for completion.

{
  "session_token": "hex-string",
  "mobile_url":    "https://peabodysecure.com/...",
  "expires_in":    900
}

// Still waiting:
{ "status": "pending" }

// Phone submitted photos:
{ "status": "complete", "verification_id": "uuid-string" }

// Session timed out:
{ "status": "expired" }

Verification Results Reference

Sanctions / AML screening

Sanctions screening runs automatically during Step 3 using the name extracted from the ID barcode. The sanctions_status field in the face match response indicates the outcome.

Face match score

The score field is an ArcFace cosine distance. Lower is more similar:

• 0.00 – 0.40: High confidence match
• 0.40 – 0.65: Match (within acceptance threshold)
• Above 0.65: Not matched — face comparison failed

Pages

Key pages on the site (direct file URLs — no rewriting):