Questions about BOIVA identity verification

BOIVA is an identity verification API platform for businesses operating onboarding and customer-verification workflows in Indonesia. It offers three products: IDVB, IDVS, and IDVC.

IDVB matches core identity data without a selfie. IDVS adds selfie comparison to identity-data verification. IDVC combines identity-data verification, selfie comparison, and liveness signals in a comprehensive flow.

Use IDVB when your workflow only needs identity-data matching. Choose IDVS when you also need a selfie comparison. Choose IDVC when your process requires layered identity, selfie, and liveness signals. Your organization remains responsible for its final policy and risk decisions.

Developers use a Client ID and Client Key to generate a public access token, then POST to /b2b/v1/identity-verification with type set to IDVB, IDVS, or IDVC. Credentials should remain in a protected server-side environment.

Yes. A business can map IDVB, IDVS, or IDVC to different onboarding paths according to the checks required at each decision point.

Use the Find a solution form to select IDVB, IDVS, or IDVC and share your expected monthly verification volume and integration requirements.

IDVB requires the type value IDVB, NIK in the ktp field, and full name. Date of birth is optional and uses yyyy-mm-dd format. IDVB does not require a selfie.

IDVS requires the type value IDVS, NIK, full name, and a Base64 selfie photo. Date and place of birth are optional. The canonical documentation specifies JPG, JPEG, or PNG images up to 5 MB and minimum dimensions of 800 by 600 pixels.

IDVC adds a documented selfie-liveness confidence score to identity-data and selfie comparison signals. It is BOIVA's broadest documented verification scope.

The normalized indicator describes certain birth-date discrepancy scenarios, including when a date derived from NIK differs from official records. It is a signal your application should handle explicitly, not an automatic rejection instruction.

The documented public access token duration is one hour. Your server should regenerate it when required and must never expose the Client ID, Client Key, or token in public code or logs.

Sandbox at sandbox.boiva.id is for development and testing. Production uses api.boiva.id with separate production credentials after the documented activation and testing process.

No. BOIVA returns verification signals. Your organization remains responsible for consent, legal basis, retention, thresholds, exception handling, and final compliance, fraud, or risk decisions.

Yes. A business can use different scopes at different decision points—for example, IDVB for an early data check and IDVS or IDVC when a later or higher-risk action needs selfie or liveness evidence.