OAuth 2.0 identity provider

Credentials stopped proving people.

QueKey doesn't tell your application that an account is logged in. It tells you a specific, live human is present right now, from five seconds of capture on any standard camera, answered in under two.

Five seconds, in your browser. Nothing is stored, and you can watch the assertion resolve.

Assertion signed 0.00s
isHumantrue
isPresenttrue
identityConfidence0.98
deepfakeRisk0.02
deviceTrust'high'
sessionTrust'verified'
Run this on your own face Uses your camera · nothing stored
The assumption that broke

Every identity system assumes a credential means a person.

That held for twenty years. Then synthesising a face, a voice or a credential got cheap. Okta, Auth0, Clerk and WorkOS all answer the same question: is this the right account. Passkeys prove possession of a device. None of them can tell you there is a person there. And the fastest growing kind of user on the internet is not a person at all: an agent, acting with real credentials, on someone's behalf or on nobody's.

5s

capture on any standard 720p camera. No dedicated hardware, no enrolled device, no app install.

<2s

from capture to a signed trust assertion, including liveness, deepfake and device checks.

0

raw biometric data touching your servers. You receive an assertion, never a face.

How the capture works

Light is the interrogation.

Your screen emits a coded illumination sequence. A real face reflects it back with depth, subsurface scatter, a corneal highlight and a pulse. A photograph, a video and a generated face do not. We read the physics, not the picture.

Photometric stereo Corneal reflection Pulse extraction Sensor forensics Deepfake-resistant Zero device dependency Raw biometrics never leave the capture
Integration

A normal OAuth flow that returns an unusual answer.

If your stack speaks OAuth 2.0, it speaks QueKey. What comes back isn't an identity. It's a trust object your application decides how to act on. Gate a login, re-verify mid-session, block a synthetic participant, authorise a payment.

Login is the first thing you can build on a
human-presence assertion. It isn't the only one.

auth.js
const { trust } = await auth.verify();

// {
// isHuman: true,
// isPresent: true,
// identityConfidence: 0.98,
// deepfakeRisk: 0.02,
// deviceTrust: 'high',
// sessionTrust: 'verified'
// }

if (trust.isHuman && trust.deepfakeRisk < 0.05) { grantAccess(); }
IAF · Interoperable Authentication Framework · patent pending

The relying party never sees a face.

01

Identity source

The user completes a five-second capture in the browser.

ENCRYPTED
PAYLOAD
02

IAF validator

Liveness physics, deepfake analysis and device attestation.

SIGNED
ASSERTION
03

Relying party

Receives a trust object and decides what to allow.

Read the IAF protocol A treatise · four chapters · eight minutes

Prove the human.

We're onboarding a small number of design partners. Every request goes to Imon Siddique, our co-founder, who takes the call himself and sets your sandbox up on it.