Identity verification API · Nigeria

One API for identity in Africa.

Mefa confirms that a person or a business is real, is who they claim to be, and is safe to onboard. One contract across every Nigerian data type, reached directly from in-country sources, with every check priced up front.

Already have an account? Sign in to the dashboard

POST https://api.mefa.co/v1/verifications
ver_01JBQ8M2K7… decision · approved

Biometric KYC

type biometric_kyc · status completed · reference signup-8841

  • consentrequired · recordedpass
  • identity_lookupfound · tier1pass
  • livenessband highpass
  • face_matchband highpass
  • duplicate0 matchespass
billing: 1 unit · biometric_kycaudit_id: aud_01JBQ8M4…
Ten Nigerian data types, one rail
National ID Phone Business registration Tax ID Voter card Vehicle Passport Bank account Card BIN Utility meter
How it works

Three steps, one shape of response

Get a key

Create an account in the dashboard, fund your wallet and generate a secret key for your server. Test keys run against fixtures and never bill.

Call one contract

POST /v1/verifications with a type, the subject's input and a consent record. Every product uses the same request, the same authentication and the same error envelope.

Results and audit

Read a decision of approved, review or rejected, the per-check detail behind it, what you were billed, and an audit reference you can keep.

Why Mefa

Built for depth in Nigeria, not breadth on a slide

The checks a regulated Nigerian business actually runs, reached directly, billed transparently and stored in-country.

Ten data types

ID, phone, business, tax, voter, vehicle, passport, bank account, card and utility meter, so verification spend stays on one rail.

Direct sources, automatic failover

Each product has an ordered chain of sources. When one fails, the next answers, and the response tells you which tier did.

Data stays in Nigeria

In-country residency, NDPA-aligned processing, consent required on every register check and an erasure endpoint for data subjects.

Published per-check pricing

One price per job type, visible in the dashboard before you integrate. A failed call is never billed.

Prepaid wallet, atomic debit

Fund yourself from the dashboard. Each job debits once, atomically, and low-balance alerts arrive before anything is declined.

Biometrics and SDKs

Face liveness, enrol, authenticate, compare and duplicate detection, with web, Android, iOS and React Native SDKs for capture.

For engineers

A decision, not a code to decipher

Every verification returns approved, review or rejected, with scores and per-check detail for teams who want their own policy. Failures are HTTP errors, never decisions, and never billed.

  • Identity data in the body, never the URL. Nothing lands in access logs or referrers.
  • Idempotency keys required. A retried request on a flaky network is never billed twice.
  • Deterministic sandbox. Test keys use the same code path against fixtures; every failure mode is reachable on purpose.
  • Secrets never reach a device. Apps get 15-minute session tokens scoped to one job.
Read the integration guide

Request · example key, not a real credential

curl https://api.mefa.co/v1/verifications \
  -H "Authorization: Bearer mefa_sk_test_EXAMPLE_KEY" \
  -H "Idempotency-Key: 9f1c4e0a-7b2d-4c7e-9a1f-2e5d8c3b6a10" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "biometric_kyc",
    "reference": "signup-8841",
    "consent": {
      "granted": true,
      "granted_at": "2026-10-12T08:59:12Z",
      "method": "sdk_ui",
      "subject_reference": "signup-8841"
    },
    "input": {
      "id_type": "nin",
      "id_number": "12345670000",
      "selfie": { "session_id": "ses_01JBQ7X…" }
    },
    "options": {
      "require_liveness": true,
      "duplicate_check": true
    }
  }'

Response · 201, abridged

{
  "id": "ver_01JBQ8M2K7…",
  "type": "biometric_kyc",
  "status": "completed",
  "decision": "approved",
  "livemode": false,
  "checks": [
    { "name": "liveness",   "result": "pass", "band": "high" },
    { "name": "face_match", "result": "pass", "band": "high" },
    { "name": "duplicate",  "result": "pass",
      "detail": { "matches": 0 } }
  ],
  "evidence": { "audit_id": "aud_01JBQ8M4…" },
  "billing":  { "billable": false, "units": 1,
                "product": "biometric_kyc" }
}
# Test keys report units but never bill.
# Live keys set billable: true.
Data stored in NigeriaIdentity data, evidence and audit records are processed and held in-country.
NDPA-alignedConsent is a required field on every register check, and subject erasure is an API call that returns a receipt.
Immutable auditEvery register lookup records who asked, which key, what was searched and which source answered.
No secrets on devicesPublishable keys only mint short-lived session tokens; secret keys stay on your server.

Start in the sandbox, go live from the same code

Request access, generate a test key and run every product against deterministic fixtures. When you are ready, fund the wallet and switch the key.