Verify the shopper at the door. Open the basket. Block restricted SKUs.

You are integrating Didit into an autonomous-retail surface — an unstaffed convenience store, an age-gated vending machine, a smart fridge, an autonomous fuel station, or a self-checkout that handles restricted SKUs. The recipe verifies identity + age at entry and authenticates returning shoppers via face only.

Three pillars:

  1. First visit — verify the shopper's identity and age with one POST /v3/session/ ($0.33 bundle).
  2. Returning visit — Biometric Authentication at $0.10 per entry. Shopper holds their face to the door camera; door unlocks.
  3. Per-SKU enforcement — block restricted categories (alcohol, tobacco, vapes, energy drinks, RX) at scan or checkout based on the verified age and the store's local rules.

Cost:
  - First visit KYC bundle: $0.33 per shopper (Sessions API)
  - Returning visit Biometric Auth: $0.10 per entry
  - First 500 verifications free every month, forever

PRE-REQUISITES
  - Production API key from https://business.didit.me (sandbox key in 60s, no card).
  - Webhook endpoint with HMAC SHA-256 verification using the X-Signature-V2 header and your webhook secret.
  - Two workflows in the Workflow Builder:
      wf_store_entry_kyc      — ID Verification + Passive Liveness + Face Match 1:1 + age rules (first visit)
      wf_store_entry_biometric — Biometric Auth-only (returning visit)
  - A store-id + local-rule lookup so age thresholds vary per region (EU 18 vs US 21 for alcohol; state-by-state tobacco; dry counties; etc.).

STEP 1 — First visit: verify the shopper

  POST https://verification.didit.me/v3/session/
  Headers:
    x-api-key: <your api key>
    Content-Type: application/json
  Body:
    {
      "workflow_id": "<wf_store_entry_kyc>",
      "vendor_data": "<your shopper id, max 256 chars>",
      "callback": "https://<your-app>/store/entry/callback",
      "metadata": {
        "purpose": "autonomous_store_entry",
        "store_id": "<your store id>",
        "region": "<US-CA | EU-ES | etc.>"
      }
    }

  Response: 201 Created with the hosted session URL. Encode that URL in the QR sticker on the door (or push it to the shopper's phone via SMS / WhatsApp). Sub-2-second median verdict on completion.

STEP 2 — Read the signed webhook on entry-flow completion

  Didit POSTs to your callback. Session statuses are Title Case With Spaces:

  Body (excerpted):
    {
      "session_id": "<uuid>",
      "vendor_data": "<your shopper id>",
      "status": "Approved",
      "id_verification": {
        "status": "Approved",
        "date_of_birth": "1991-04-22",
        "country": "US"
      },
      "liveness": { "status": "Approved" },
      "face": { "status": "Approved", "similarity_score": 0.94 }
    }

  Status enum (exact case): Approved | Declined | In Review | Resubmitted | Expired | Not Finished | Kyc Expired | Abandoned.

  Verify the X-Signature-V2 header BEFORE reading the body — HMAC SHA-256 of the raw bytes with your webhook secret.

  Compute the age from date_of_birth, look up the region's age thresholds (per category), and store the (shopper_id, age_band, region, kyc_status) tuple in your data layer.

STEP 3 — Open the door

  When status is Approved, signal your store-OS / door-controller to unlock. Median wall-clock from QR scan to door open is around 1.4 seconds on entry-level Android, sub-2 seconds end to end.

  Failure modes to handle:
    Declined / In Review / Resubmitted — show a friendly UI on the kiosk and offer staff hand-off.
    Expired / Abandoned — shopper walked away; do nothing, the session expires.

STEP 4 — Returning visit: Biometric Authentication

  POST https://verification.didit.me/v3/session/
  Body:
    {
      "workflow_id": "<wf_store_entry_biometric>",
      "vendor_data": "<your shopper id>",
      "metadata": {
        "purpose": "autonomous_store_entry_return",
        "store_id": "<your store id>"
      }
    }

  The shopper just holds their face to the door camera. Cost is $0.10 per entry. Same webhook flow.

STEP 5 — Read the decision on demand

  GET https://verification.didit.me/v3/session/{sessionId}/decision/
  Headers:
    x-api-key: <your api key>

  Returns the full decision JSON. Use this from the POS / self-checkout when the shopper picks up a restricted SKU — confirm age + region match the SKU's rules before letting the basket close.

STEP 6 — Per-SKU enforcement at checkout

  Inside your POS / store-OS, every restricted SKU carries a category tag (alcohol, tobacco, vape, energy-drink, sharp-tool, RX). Look up the shopper's verified age band + the store's region rules. Examples:

    Alcohol            US-21 / EU-18, blocked in dry counties, time-of-day windows
    Tobacco / vapes    US-21 (state by state) / EU-18, store-licence flag required
    Energy drinks      EU-16 in some regions, no restriction elsewhere
    Sharp tools        ≥ 18 in most regions
    Prescription       Pharmacy hand-off only (DEA Schedule II–V)

  Tune the policy in the no-code Workflow Builder — no redeploy of your store-OS.

WEBHOOK EVENT NAMES
  - Sessions: status changes flow through the standard session webhook.
  - Verify X-Signature-V2 on every payload.

CONSTRAINTS
  - Session statuses use Title Case With Spaces (Approved, In Review). Don't transform them.
  - Don't store the raw document image in your store-OS — Didit holds it, the store-OS holds the shopper PID + age band only.
  - Compute the age band server-side, not in the kiosk — kiosks can be tampered with.
  - Log every entry attempt (Approved + Declined) signed with X-Signature-V2 for the loss-prevention dashboard. Default retention 5 years.

Read the docs:
  - https://docs.didit.me/sessions-api/create-session
  - https://docs.didit.me/sessions-api/retrieve-session
  - https://docs.didit.me/integration/webhooks
  - https://docs.didit.me/console/workflows

Start free at https://business.didit.me — sandbox key in 60 seconds, 500 verifications free every month, no credit card.