A verification API you can reason about.

curl https://api.semperid.ng/v1/identity/nin/details \
  --header "Authorization: Bearer $SEMPERID_API_KEY" \
  --header "Content-Type: application/json" \
  --header "Idempotency-Key: signup-2291-nin" \
  --data '{
    "nin": "11111111110"
  }'

// Run on your server. Never ship your API key to a browser.
const response = await fetch(
  'https://api.semperid.ng/v1/identity/nin/details',
  {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${process.env.SEMPERID_API_KEY}`,
      'Content-Type': 'application/json',
      'Idempotency-Key': 'signup-2291-nin',
    },
    body: JSON.stringify({ nin: '11111111110' }),
  },
);
const result = await response.json();

# Run on your server. Never ship your API key to a browser.
import os
import requests

response = requests.post(
    "https://api.semperid.ng/v1/identity/nin/details",
    headers={
        "Authorization": f"Bearer {os.environ['SEMPERID_API_KEY']}",
        "Idempotency-Key": "signup-2291-nin",
    },
    json={"nin": "11111111110"},
    timeout=30,
)
result = response.json()

// Verify a delivery against the exact bytes received.
import { createHmac, timingSafeEqual } from 'node:crypto';

export function isFromSemperID(rawBody, headers, secret) {
  const timestamp = headers['semperid-timestamp'];
  const signature = headers['semperid-signature'] ?? '';
  const expected = createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');
  // Also reject timestamps more than 300 seconds old.
  return (
    signature.length === expected.length &&
    timingSafeEqual(Buffer.from(signature), Buffer.from(expected))
  );
}