Developers

Issue a key from your business account. Keys look like uto_live_… and are stored only as a hash — copy it the moment it is shown. Send it as a bearer token.

curl -X POST https://uto.bio/api/public/v1/verify \
  -H "Authorization: Bearer uto_live_xxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{ "iverifyNumber": "USA#458945984589489TFO" }'

Response

{
  "valid": true,
  "status": "verified",
  "score": 88,
  "tier": "Gold",
  "verifiedAt": "2026-02-11T09:14:22.108Z",
  "modules": ["biometric", "id_doc", "face_match", "identity", "address", "phone", "email"]
}

An unknown or malformed iVerify™ number returns valid: false with a 200 so you can branch without try/catch. Bad keys return 401.

Mint a signed identity assertion any UTO™ system can verify offline. Tokens are compact HS256 JWTs — header.payload.signature — carrying the holder’s iVerify™ number, tier and credibility score.

curl -X POST https://uto.bio/api/auth/uto \
  -H "x-api-key: uto_live_xxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "token",
    "iverify_number": "USA#458945984589489TFO",
    "audience": "ibank",
    "scope": "identity:read wallet:read",
    "ttl_seconds": 3600
  }'

Response

{
  "token_type": "Bearer",
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.…",
  "alg": "HS256",
  "issuer": "https://uto.bio/auth0",
  "audience": "ibank",
  "expires_in": 3600,
  "jti": "0f2c…",
  "uto_user_id": "1c6f…"
}

Send { "action": "verify_token", "token": "…" } to check one you received; expired, mis-audienced or tampered tokens return 401 with a reason. Same endpoint also serves signup, link and lookup.

One import, every endpoint — with timeouts, retries and 429 back-off built in. Works in Node 18+, Bun, Deno, Cloudflare Workers and modern browsers (keep the key server-side).

import { IVerify } from "https://uto.bio/sdk/iverify.js";

const iv = new IVerify({ apiKey: process.env.IVERIFY_API_KEY });

const who = await iv.verify("USA#458945984589489TFO");
if (who.verified && who.credibility_score >= 88) grantAccess();

const { access_token } = await iv.token({
  iverify_number: who.iverify_number,
  audience: "ibank",
  scope: "identity:read wallet:read",
});

Methods: verify, signup, link, lookup, token, verifyToken.

Every public endpoint sits behind three gates: a shield against hostile payloads, a bot filter for keyless automated clients, and a sliding-window limiter keyed to your API key (300/min on verify, 120/min on auth). Denials return 429 with a Retry-After header — the SDK waits and retries for you. Every decision is logged for audit.

The ID and face-match modules run inside Socure’s hosted flow (docv_socure_pass), including Socure Pass reuse for returning people. We never decide from the browser: the final ACCEPT / REJECT arrives on /api/public/socure-webhook and is written straight onto the verification record.

Every verified holder gets uto.bio/theirname carrying their iVerify™ number, tier and score — and can point a bought domain at it with a CNAME to backlinks.uto.bio plus a TXT ownership record.

Point Chargebee at /api/public/chargebee-webhook with the shared token. Events are de-duplicated by event id, so retries are safe, and subscription state lands on the matching account within seconds.

Deployed on Spaceship™ HyperLift™ edge regions. Starter allows 1,000 verifications a month, White-Label 10,000, Enterprise unlimited with a 99.99% SLA.