All Products
Search
Document Center

ID Verification:InitializeV2

Last Updated:Oct 27, 2026

This article describes how to use the InitializeV2 API to initiate a FACE_IDU request.

API information

  • API operation: InitializeV2

  • Request method: HTTPS POST

  • Description: Call this operation before starting a verification session to obtain a transactionId. This ID links all API calls within that session.

  • QPS limit: Each API has its own QPS limit. For more information, see QPS limits of ID Verification server-side APIs.

  • Service endpoints:

    Note
    • Benefits of internal network access: An internal network is a private communication network connecting Alibaba Cloud products within the same region. If your application server is deployed in the same region, use the internal endpoint to access the ID Verification service for enhanced security and stability.

    • Optimizing overseas access: Overseas network environments can be complex. Refer to Optimize server network latency to tune your integration and reduce network latency and request failures.

    Asia Pacific SE 1 (Singapore)

    • Public endpoint: cloudauth-intl.ap-southeast-1.aliyuncs.com

    • Internal endpoint: cloudauth-intl-vpc.ap-southeast-1.aliyuncs.com

    Indonesia

    • Public endpoint: cloudauth-intl.ap-southeast-5.aliyuncs.com

    • Internal endpoint: cloudauth-intl-vpc.ap-southeast-5.aliyuncs.com

    China (Hong Kong)

    • Public endpoint: cloudauth-intl.cn-hongkong.aliyuncs.com

    • Internal endpoint: cloudauth-intl-vpc.cn-hongkong.aliyuncs.com

    Asia Pacific SE 3 (Kuala Lumpur)

    • Public endpoint: cloudauth-intl.ap-southeast-3.aliyuncs.com

    • Internal endpoint: cloudauth-intl-vpc.ap-southeast-3.aliyuncs.com

Online debugging and integration

Note

Before debugging and integration, read the Use OpenAPI document to learn how to call APIs on the OpenAPI platform and obtain the SDK.

You can directly run this API in OpenAPI Explorer to debug it, and generate an SDK code example.

Integration notes

  • A TransactionId is returned only upon successful initialization. You must complete the authentication within 30 minutes of obtaining the TransactionId or TransactionUrl. The TransactionId is for one-time use only. The ID immediately becomes invalid and cannot be reused to launch the SDK, regardless of whether the authentication succeeds, fails, or is canceled by the user. To start the authentication again, you must request a new TransactionId from the server-side.

  • The TransactionUrl, returned only in Web SDK scenarios, is a single-use URL. Do not concatenate, modify, or reuse it.

  • Due to network latency, the CallbackUrl notification may be delayed. After receiving the completion notification, the client must call the server's CheckResult API to retrieve the final authentication result. Do not rely solely on the callback notification or the results displayed on the page.

  • The App SDK and Web SDK differ in functionality. The Web SDK's behavior also varies between mobile H5 and desktop environments. For details on feature support, refer to the integration documentation.

  • The logic for the AutoRegistration enum value is the inverse of a standard boolean value: 0 enables auto registration, and 1 disables it. Pay close attention to this distinction during integration to avoid configuration errors.

  • The merchant user ID (MerchantUserId) must maintain a stable mapping to your business users. In face enrollment scenarios, this ID must also be unique; a duplicate ID will cause face registration to fail.

  • If the UpdateFaceIfUserExists parameter is set to Y and a user with the specified MerchantUserId already exists, the system overwrites that user's existing face data with the new image to complete the registration and enrollment.

Request parameters

Request fields

The InitializeV2 operation is the unified server-side initialization endpoint for both the App SDK and the Web SDK, with the product code set to FACE_IDU. Both SDKs share the three verification modes, face group parameters, target face parameters, and auto-registration parameters associated with FACE_IDU. The main differences are client-side configurations for liveness detection, web page settings, and response fields.

Integration method

Use case

API response

Parameters

App SDK

For verifying users in a native Android or iOS app.

TransactionId, Protocol

Common parameters + App SDK-specific parameters

Web SDK

For verifying users on a mobile H5 page, an embedded H5 page in an app, or a PC browser.

TransactionId, TransactionUrl, Protocol

Common parameters + Web SDK-specific parameters

The parameters are categorized as follows:

  • Common parameters: Used for both integration methods.

  • App SDK-specific parameters: Controls the liveness detection workflow.

  • Web SDK-specific parameters: Controls page redirects, language, UI, and H5 fallback.

Three verification modes

Verification mode

VerifyModel value

Core logic

Use case

Key parameters

Auto-registration condition

Validation mode (default)

1

liveness detection + 1:1 validation

Logins, account recovery, and sensitive action confirmations.

TargetFacePicture, TargetFacePictureUrl, or TargetFacePictureFile (Choose one of the three to specify the target face)

Not applicable

Retrieve mode

0

liveness detection + 1:N retrieval

Preventing duplicate registrations for new users and enforcing one account per person.

FaceGroupCodes (Specifies the face groups to search).
ReturnFaces (Optional. Specifies the number of faces to return that exceed the matching threshold.)

Liveness detection passes, and 1:N retrieval finds no match.

Comprehensive mode

2

liveness detection + 1:1 validation + 1:N retrieval

New user registration that requires both identity confirmation and duplicate checking.

Requires all key parameters for both validation mode (value 1) and retrieve mode (value 0).

Liveness detection passes, 1:1 validation passes, and 1:N retrieval finds no match.

Common parameters

Parameter

Type

Required

Description

Example

ProductCode

String

Yes

The product code. Set the value to FACE_IDU.

FACE_IDU

SceneCode

String

No

A custom ID for the authentication scenario. Use this ID to retrieve records from the console. The ID can be a 10-character string that consists of letters, numbers, and underscores.

1234567890

MerchantBizId

String

Yes

A unique business identifier for the merchant, used to identify and troubleshoot issues. The identifier is a 32-character string of letters and numbers. The server-side does not validate the uniqueness of this ID. The merchant must ensure that the ID is unique.

e0c34a77f5ac40a5aa5e6ed20c35****

MetaInfo

String

Yes

Client environment information. Generate this information using the corresponding SDK. If you create it yourself, you must at least pass the correct deviceType value.

Example code:

{
  "deviceType": "h5"
}

Valid values for deviceType:

  • Native Android app: android

  • Native iOS app: ios

  • Embedded H5 page: h5

  • PC web page: web

Important

Use the authentication SDK to obtain MetaInfo. This provides more accurate and detailed client information for scenarios such as authentication URL issuance, log investigation, and security checks. If you create a static MetaInfo value, make sure that `deviceType` matches the actual environment. An incorrect value will cause errors when the authentication URL is issued.

{
  "zimVer": "3.0.0",
  "appVersion": "1",
  "bioMetaInfo": "4.1.0:1150****,0",
  "appName": "com.aliyun.antcloudauth",
  "deviceType": "ios",
  "osVersion": "iOS 10.3.2",
  "apdidToken": "",
  "deviceModel": "iPhone9,1"
}

MerchantUserId

String

Yes

A custom user identifier, or another recognizable user identifier, such as a mobile phone number or email address. We recommend that you desensitize or hash this field.

123456789

CallbackUrl

String

No

The callback URL for the authentication result. This URL must start with https. The platform makes a GET request to this URL and appends the transactionId, passed, and subcode parameters.

The platform returns an HTTP 400 error if the URL is not publicly accessible.

https://www.aliyun.com?callbackToken=100000****&transactionId=shaxxxx&passed=Y&subCode=200

CallbackToken

String

No

A custom security token for the merchant. Once set, this token is returned unchanged with the CallbackUrl for anti-replay and tamper-proofing verification.

NMjvQanQgplBSaEI0sL********

SecurityLevel

String

No

The security level. Valid values:

  • 01: Normal mode. Recommended for test environments to improve testing efficiency.

  • 02: Secure mode (default). Strongly recommended for production environments.

02

Model

String

No

Liveness detection type:

  • SILENT: Silent (Supported by Naive SDK 1.3.6 and later)

  • LIVENESS: Blink (default)

  • PHOTINUS_LIVENESS: Blink and color flash (Not supported in PC mode)

  • TEMPLATE: Custom liveness detection action (Not supported by Web SDK. Supported by Naive SDK 1.3.6 and later.)

PHOTINUS_LIVENESS

DocVideo

String

No

Specifies whether to capture a 1- to 2-second evidence video during the face verification process. Valid values:

  • Y: Yes

  • N (default): No

Video files are large. On unstable networks, the system may discard the video to prioritize uploading essential images.

To get the video URL, check the Result.ExtFaceInfo.docVideoUrl parameter in the CheckResult response.

N

FaceAttributeCheck

String

No

Face Recognition Configuration: Specifies whether to return additional facial attributes.

  • N: No (default)

  • Y: Returns.

The output is returned in `Checkresult` at Result.ExtFaceInfo.faceAttributeInfo.

N

VerifyModel

String

No

[Product settings] The verification mode:

  • 1 validation mode: 1:1 verification (default)

  • 0 retrieve mode: 1-to-N retrieval

  • 2Comprehensive mode: 1:1 verification + 1:N retrieval

0

TargetFacePicture

String

Required when VerifyModel is 1 or 2. Choose one of the three upload methods.

[Product settings - 1:1 validation] The Base64-encoded string of the trusted target face image for 1:1 comparison.

base64

TargetFacePictureUrl

String

[Product settings - 1:1 validation] The URL of the face image. The URL must be a publicly accessible HTTP or HTTPS link.

https://***face1.jpeg

TargetFacePictureFile

InputStream

[Product settings - 1:1 validation] The file stream of the face image.

See Special Scenarios: Configuring the Advance Interface for File Uploads.

FaceGroupCodes

String

Required when VerifyModel is 0 or 2.

[Product settings - 1:N retrieval] The codes of face groups for 1:N retrieval. You can obtain the code when you create a face group in the ID Verification console. You can specify up to 10 face groups at a time. Use commas (,) to separate multiple face group codes.

sg*****xta,s*****uk3j

ReturnFaces

String

Optional when VerifyModel is 0 or 2.

[Product settings - 1:N retrieval] The number of matching faces to return when multiple faces exceed the match threshold. Default: 1. Maximum: 5.

1

AutoRegistration

String

Optional when VerifyModel is 0 or 2.

[Product settings - 1:N retrieval] Specifies whether to automatically register the face to a face group after successful verification:

  • 0: Enable auto-registration.

  • 1: Disable auto-registration (default).

0

FaceRegisterGroupCode

String

Required when VerifyModel is 0 or 2, and AutoRegistration is 0.

[Product settings - 1:N retrieval] The code of the target face group for auto-registration.

sg*****xta

UpdateFaceIfUserExists

String

Optional when VerifyModel is 0 or 2.

[Product Solution Configuration - 1:N Search] If the MerchantUserId already exists during auto-registration, overwrite the existing face with the new one:

  • Y: Overwrite.

  • N: Do not overwrite (default). The service returns a "UserId already exists" error.

N

ShowGuidePage

String

No

UI configuration: Show guide page:

  • 1: Show (default)

  • 0: Do not show

PC mode does not support this configuration.

Supported in Native SDK version 1.4.0 and above.

1

App SDK parameters

The following parameters are supported only by the native App SDK.

Parameter

Type

Required

Description

Example

AppQualityCheck

String

No

[Face Scan Configuration] Specifies whether to enable strict face quality detection.

  • Y: Enabled (default)

  • N: Disabled

Supported only in Native SDK v1.2.5 and later. The face quality detection module must be integrated.

N

TemplateConfig

String

Conditional

[Face Scan Configuration] The custom action pool. This parameter is required when Model is set to TEMPLATE.

  • Configuration rule: Separate multiple action codes with commas.

  • Best practice: A blinking action is required, and the total number of actions must not exceed three.

Action code lookup table:

  • Blink: 01 (required)

  • Open mouth: 02

  • Shake head left: 03

  • Shake head right: 04

  • Move camera away: 05

  • Move camera closer: 06

  • Color liveness detection: 07

Supported in Native SDK v1.3.6 and later.

01,02,07

TemplateType

String

Conditional

[Face Scan Configuration] The execution order of liveness detection actions in TemplateConfig.

This parameter is required when Model is set to TEMPLATE.

  • Seq: Actions are executed from left to right in the order they are configured in TemplateConfig.

Supported in Native SDK v1.3.6 and later.

Seq

NeedMultiFaceCheck

String

No

[Face Scan Configuration] Determines whether to block the request when multiple faces are detected by the terminal.

  • Y: Block the request and prompt the client to retry face recognition.

  • N: Do not block; select the largest face in the frame and submit it to the server for security verification. (Default)

Supported in Native SDK version 1.4.1 and above.

Y

Web SDK parameters

The following parameters are supported only by the Web SDK.

Parameter

Type

Required

Description

Example

LanguageConfig

String

No

A JSON string for the custom language configuration. To apply the settings, convert your configuration to a JSON string based on the provided template and pass it as this parameter. For more information, see Customize Web SDK languages.

Note

Supported only in the mobile integration mode of the Web SDK.

{
  "languageContent": {****},
  "ocrResultContent": {****},
  "supportedLanguage": [****],
  "titleTranslate": {****},
}

StyleConfig

String

No

A JSON string for the custom UI configuration. To apply the configuration, convert your settings to a JSON string based on the provided template and pass it as this parameter. For more information, see Customize IDV UI styles.

Note

Supported only in the mobile integration mode of the Web SDK.

{
  "guidepage:": {****}, 
  "ocrPage": {****},
  "ocrResultPage": [****],
  "facePage": {****},
}

ReturnUrl

String

Conditional

The URL to redirect to after authentication. This is optional for the iframe embedded pattern. Provide this URL for page redirect scenarios that do not use an iframe.

https://www.alibabacloud.com

ProcedurePriority

String

No

Specifies whether to display a fallback method when a compatibility issue occurs during mobile H5 authentication.

  • url: Supports fallback. The page displays the authentication URL. Users can copy the URL and open it in a different browser to continue authentication. (Default)

  • keep: Does not support fallback. An error reason is returned, and the authentication flow ends. This option is not supported on PCs. Recommended for webpages embedded in an app.

url

Response parameters

Differences in returned fields

Field

App SDK

Web SDK

Note

RequestId / Code / Message

Yes

Yes

General response information.

Result.TransactionId

Yes

Yes

This is the unique identifier for the authentication flow, a field for billing statistics, and a request parameter for the CheckResult operation. Attach this identifier to the merchant business ID and store it only on the server-side.

Result.Protocol

Yes

Yes

Standard authentication and encryption protocol. Pass this through to the client SDK. The Web SDK requires this field for iframe embedding.

Result.TransactionUrl

No

Yes

The Web SDK authentication URL. After authentication, it redirects to the ReturnUrl. This URL cannot be modified and can be accessed only once. You must complete the authentication within 30 minutes of obtaining the URL or TransactionId.

Parameter

Type

Description

Example

HTTP status code

Integer

The HTTP status code.

200

HTTP body

RequestId

String

The request ID.

130A2C10-B9EE-4D84-88E3-5384FF03****

Code

String

The return code. For more information, see Server-side HTTP status codes.

Success

Message

String

A detailed description of the return code.

success

Result.TransactionId

String

A unique identifier for the authentication flow. This identifier is used for billing and is required for calls to the CheckResult API.

Important
  • The init API does not return a TransactionId if the request fails, for example, due to an invalid parameter.

  • Bind the TransactionId to your business process ID and store it on the server-side. When calling the CheckResult API, retrieve this ID from your server-side storage.

  • The TransactionId or TransactionUrl is valid for 30 minutes. You must complete the authentication within this period, after which the ID expires.

hksb7ba1b28130d24e015d6********

Result.TransactionUrl

String

The verification URL for the Web SDK. After verification is complete, the user is redirected to the ReturnUrl that you provided in the request.

Important
  • Do not modify the TransactionUrl during the integration process. Doing so will cause a verification exception.

  • The TransactionUrl is for single use only. Reusing it will cause a verification exception.

  • After you obtain the TransactionId or TransactionUrl, you have 30 minutes to complete the verification before the ID or URL expires.

https://www.alibabacloud.com/index.html?clientcfg=****

Result.Protocol

String

The encrypted string for the standard authentication protocol.

Passing this parameter to the client SDK reduces network interactions and supports dynamic network switching, which improves the user experience.

hksb7ba1b28130d24e015d*********

Request examples

App SDK 1:1 verification mode

Minimal request

When the VerifyModel parameter is set to 1, the system performs only liveness detection and a 1:1 comparison against the target face. It does not perform a face library search or trigger automatic registration.

{
  "ProductCode": "FACE_IDU",
  "MetaInfo": "{\"deviceType\":\"android\"}",
  "MerchantUserId": "user_hash_value",
  "VerifyModel": "1",
  "TargetFacePictureUrl": "https://example.com/trusted-face.jpg"
}

Full request

{
  "ProductCode": "FACE_IDU",
  "SceneCode": "login_check_01",
  "MerchantBizId": "biz_20230805123456789",
  "MetaInfo": "{\"deviceType\":\"android\",\"osVersion\":\"Android 12\",\"deviceModel\":\"Pixel 6\"}",
  "MerchantUserId": "user_hash_value_123",
  "CallbackUrl": "https://www.example.com/callback",
  "SecurityLevel": "02",
  "Model": "PHOTINUS_LIVENESS",
  "DocVideo": "N",
  "VerifyModel": "1",
  "TargetFacePictureUrl": "https://example.com/trusted-face.jpg",
  "AppQualityCheck": "Y",
  "ShowGuidePage": "1"
}

Web SDK 1:1 verification mode

Minimal request

When the VerifyModel parameter is set to 1, the system performs only liveness detection and a 1:1 comparison against the target face. It does not perform a face library search or trigger automatic registration.

{
  "ProductCode": "FACE_IDU",
  "MetaInfo": "{\"deviceType\":\"h5\"}",
  "MerchantUserId": "user_hash_value",
  "VerifyModel": "1",
  "TargetFacePictureUrl": "https://example.com/trusted-face.jpg",
  "ReturnUrl": "https://example.com/face-idu/result"
}

Full request

{
  "ProductCode": "FACE_IDU",
  "SceneCode": "web_login_01",
  "MerchantBizId": "biz_20230805987654321",
  "MetaInfo": "{\"deviceType\":\"h5\"}",
  "MerchantUserId": "user_hash_value_456",
  "CallbackUrl": "https://www.example.com/callback",
  "ReturnUrl": "https://example.com/face-idu/result",
  "SecurityLevel": "02",
  "Model": "LIVENESS",
  "VerifyModel": "1",
  "TargetFacePictureUrl": "https://example.com/trusted-face.jpg",
  "ShowGuidePage": "1",
  "ProcedurePriority": "url"
}

App SDK 1:N search mode

Minimal request

When the VerifyModel parameter is set to 0, the system performs liveness detection and a 1:N search within the specified face library. In a minimal request, automatic registration is disabled by default. Therefore, the AutoRegistration and FaceRegisterGroupCode parameters are omitted.

{
  "ProductCode": "FACE_IDU",
  "MetaInfo": "{\"deviceType\":\"android\"}",
  "MerchantUserId": "user_hash_value",
  "VerifyModel": "0",
  "FaceGroupCodes": "sg*****xta"
}

Full request

{
  "ProductCode": "FACE_IDU",
  "SceneCode": "new_user_reg_01",
  "MerchantBizId": "biz_20230805abcdefg",
  "MetaInfo": "{\"deviceType\":\"android\",\"osVersion\":\"Android 11\"}",
  "MerchantUserId": "user_hash_value_789",
  "SecurityLevel": "02",
  "Model": "SILENT",
  "VerifyModel": "0",
  "FaceGroupCodes": "sg*****xta,sg*****uk3j",
  "ReturnFaces": "3",
  "AutoRegistration": "0",
  "FaceRegisterGroupCode": "sg*****xta",
  "UpdateFaceIfUserExists": "N",
  "AppQualityCheck": "Y",
  "ShowGuidePage": "1"
}

Web SDK 1:N search mode

Minimal request

When the VerifyModel parameter is set to 0, the system performs liveness detection and a 1:N search within the specified face library. In a minimal request, automatic registration is disabled by default. Therefore, the AutoRegistration and FaceRegisterGroupCode parameters are omitted.

{
  "ProductCode": "FACE_IDU",
  "MetaInfo": "{\"deviceType\":\"h5\"}",
  "MerchantUserId": "user_hash_value",
  "VerifyModel": "0",
  "FaceGroupCodes": "sg*****xta",
  "ReturnUrl": "https://example.com/face-idu/result"
}

Full request

{
  "ProductCode": "FACE_IDU",
  "SceneCode": "web_reg_01",
  "MerchantBizId": "biz_20230805hijklmn",
  "MetaInfo": "{\"deviceType\":\"h5\"}",
  "MerchantUserId": "user_hash_value_000",
  "ReturnUrl": "https://example.com/face-idu/result",
  "SecurityLevel": "02",
  "Model": "LIVENESS",
  "VerifyModel": "0",
  "FaceGroupCodes": "sg*****xta",
  "AutoRegistration": "0",
  "FaceRegisterGroupCode": "sg*****xta",
  "ShowGuidePage": "1"
}

App SDK comprehensive mode (1:1 and 1:N)

Minimal request

When the VerifyModel parameter is set to 2, the system performs both a 1:1 comparison against the target face and a 1:N search within the specified face library. In a minimal request, automatic registration is disabled by default.

{
  "ProductCode": "FACE_IDU",
  "MetaInfo": "{\"deviceType\":\"ios\"}",
  "MerchantUserId": "user_hash_value",
  "VerifyModel": "2",
  "TargetFacePictureUrl": "https://example.com/trusted-face.jpg",
  "FaceGroupCodes": "sg*****xta"
}

Full request

{
  "ProductCode": "FACE_IDU",
  "SceneCode": "app_comprehensive_01",
  "MerchantBizId": "biz_20230805opqrst",
  "MetaInfo": "{\"deviceType\":\"ios\",\"osVersion\":\"iOS 15.0\",\"deviceModel\":\"iPhone 13\"}",
  "MerchantUserId": "user_hash_value_111",
  "SecurityLevel": "02",
  "Model": "PHOTINUS_LIVENESS",
  "VerifyModel": "2",
  "TargetFacePictureUrl": "https://example.com/trusted-face.jpg",
  "FaceGroupCodes": "sg*****xta",
  "AutoRegistration": "0",
  "FaceRegisterGroupCode": "sg*****xta",
  "AppQualityCheck": "Y",
  "ShowGuidePage": "1"
}

Web SDK comprehensive mode (1:1 and 1:N)

Minimal request

When the VerifyModel parameter is set to 2, the system performs both a 1:1 comparison against the target face and a 1:N search within the specified face library. In a minimal request, automatic registration is disabled by default.

{
  "ProductCode": "FACE_IDU",
  "MetaInfo": "{\"deviceType\":\"h5\"}",
  "MerchantUserId": "user_hash_value",
  "VerifyModel": "2",
  "TargetFacePictureUrl": "https://example.com/trusted-face.jpg",
  "FaceGroupCodes": "sg*****xta",
  "ReturnUrl": "https://example.com/face-idu/result"
}

Full request

{
  "ProductCode": "FACE_IDU",
  "SceneCode": "web_comprehensive_01",
  "MerchantBizId": "biz_20230805uvwxyz",
  "MetaInfo": "{\"deviceType\":\"h5\"}",
  "MerchantUserId": "user_hash_value_222",
  "ReturnUrl": "https://example.com/face-idu/result",
  "SecurityLevel": "02",
  "Model": "LIVENESS",
  "VerifyModel": "2",
  "TargetFacePictureUrl": "https://example.com/trusted-face.jpg",
  "FaceGroupCodes": "sg*****xta",
  "AutoRegistration": "0",
  "FaceRegisterGroupCode": "sg*****xta",
  "ShowGuidePage": "1"
}