PingOne Recognize

Enrollment

Before users can authenticate with PingOne Recognize, they must be enrolled. Enrollment registers a user’s face and device, creating a biometric template that future authentication attempts are compared to. PingOne Recognize supports two enrollment methods: live enrollment and IDV Bridge enrollment.

Live Enrollment

Who it’s for

Businesses that want to use the PingOne Recognize selfie-capture process either:

  1. During onboarding of new users.

  2. As a way to enhance the authentication experience for existing authenticated users (by enhancing security and usability).

What it does

With live enrollment, PingOne Recognize provides a user interface to create a digital identity, which is then used as a base template when a user attempts to authenticate in the future.

This involves capturing facial biometrics and device details. Passive liveness technology also helps ensure that the user is a real person.

How it works

Mobile SDK

The PingOne Recognize Mobile SDK allows you to embed selfie capture and enrollment into your own Android or iOS app.

This is the recommended and most secure approach, as the selfie is processed exclusively on the customer’s device and no biometric data is stored after enrollment.

Learn more in Mobile SDK.

Web SDK

The PingOne Recognize Web SDK allows you to integrate the enrollment experience into your web-based services. The captured image is securely encrypted and sent to the PingOne Recognize server, where it is transformed into a private key. No biometric data is stored.

IDV Bridge

Who it’s for?

Businesses that have already created a biometric template as part of an existing Know Your Customer (KYC) or Identity Verification (IDV) flow.

What it does

IDV Bridge uses a user’s existing portrait for future authentication attempts. This removes the need for live enrollment while linking PingOne Recognize authentication to a portrait or selfie captured during onboarding.

Typically, clients use this solution in one of two ways:

  1. Bulk upload of selfies: Clients who’ve collected a significant number of selfies or identity documents, typically during onboarding or KYC, can use IDV Bridge to passively enroll users into the PingOne Recognize system for ongoing authentication.

  2. Single selfie upload: Clients that already have a selfie-capture step in their onboarding flow can send this image to IDV Bridge to enroll users into PingOne Recognize without adding an additional step.

This approach reduces risk by transforming facial biometric data into a secure cryptographic key, enabling image deletion, and improving user experience by removing the need for active live enrollment with PingOne Recognize.

How it works

PingOne Recognize has two deployment options for uploading previously captured face portraits:

  1. IDV Bridge SaaS: A backend-to-backend option where businesses pass encrypted images to the authentication service API for enrollment.

    Learn more in IDV Bridge SaaS.