Face Public Key
Generate a face-purpose based public key
The /face-public-key endpoint derives and returns the face-based public key for a given purpose_id and key_type, without issuing a full Face Certificate. This is useful when you need the raw public key for external use — for example, to share with a third party who will verify signatures or perform key encapsulation independently.
The public key returned is the same key that would be embedded in a Face Certificate generated with the same purpose_id and key_type. Since this endpoint verifies the SensePrint, it consumes verification quota from your license.
A liveness check is always performed.
Example Request:
{
"face_base_64": "face_base_64",
"key_type": "MlKem512",
"liveness_tolerance": null,
"os": null,
"password": "(optional) password",
"purpose_id": "login:www.example.com",
"senseprint_base_64": "senseprint_base_64",
"verifiers_auth_key": "(optional) verifiers_auth_key"
}Here, the key_type specifies the Key algorithm for the derived public key. See table below.
| key_type | Algorithm | Typical use |
|---|---|---|
| Secp256k1 | ECDSA (secp256k1) | Signature verification, classic encryption |
| MlDsa44 | ML-DSA-44 (NIST FIPS 204) | Post-quantum signature verification |
| MlDsa65 | ML-DSA-65 (NIST FIPS 204) | Post-quantum signature verification (higher security) |
| MlDsa87 | ML-DSA-87 (NIST FIPS 204) | Post-quantum signature verification (highest security) |
| MlKem512 | ML-KEM-512 (NIST FIPS 203) | Post-quantum key encapsulation / encryption |
| MlKem768 | ML-KEM-768 (NIST FIPS 203) | Post-quantum key encapsulation (higher security) |
| MlKem1024 | ML-KEM-1024 (NIST FIPS 203) | Post-quantum key encapsulation (highest security) |
Note: The key_type and purpose_id must match what was used (or will be used) in /face-sign or /generate-face-certificate — they are inputs to the key derivation. The same face + SensePrint + purpose_id + key_type combination always produces the same public key.
Example Response:
The public key returned is in PEM format and matches the requested key type (ML-DSA, ML-KEM, or Secp256k1).
{
"public_key_pem": "-----BEGIN PUBLIC KEY----- ... -----END PUBLIC KEY-----"
}