Your screen emits a short sequence of coloured light. A real face returns it with depth, a corneal highlight and a pulse. A photograph, a replayed video and a generated face do not. Five seconds, and you'll see the assertion resolve exactly as an application would.
Your browser will ask for camera permission next. Frames are analysed and discarded. Nothing is written to disk, and no image is retained after the assertion is signed.
It lands by email carrying a single pending request. No app install, no enrolled device, no prior setup. Opening it on any browser with a standard camera starts the capture. It resolves the moment it is answered, and expires on its own if it is not.
The signed trust object returns to the relying party. The link is spent.
A receipt is sent, the link is revoked, and the account is left untouched.
The account locks for twenty-four hours and security is notified. Nothing was captured.
No action and no notice. The drop dies on its own.
A standard OAuth 2.0 authorization request moves you from the application to QueKey. The same flow you already use for Google or GitHub.
Seven illumination frames are emitted and read back. Photometric depth, corneal reflection, pulse and sensor forensics are computed from the response.
The application receives an authorization code, exchanges it for a signed assertion, and reads six scores, never a photograph.
Imon Siddique, CTO, walks through a full passwordless authentication against a live application, presented at Atal Incubation Centre.
Roughly five seconds of video at 720p, used to compute the liveness signals and a 512-dimensional embedding. The embedding is a set of numbers; a face cannot be reconstructed from it.
For this demo, nothing. Frames are held in memory for the length of the capture and discarded once the assertion is signed or refused.
A signed token and six scores. The relying party, including this page, never sees an image, and never holds anything it could be breached for.