Skip to content

1. Overview

What the Link Identity Platform is, the capabilities every Link product builds on, and how integrators connect to it.

1.1 What It Is

Link Identity Platform is a general-purpose biometric identity service that provides a fully configurable identity stack to all tenants. Every tenant can enable the capabilities they need: user management, authentication, KYC verification, palm biometrics, sessions, and compliance.

Link Identity Platform system architecture: clients (mobile apps, web console, palm-vein scanners, 3rd-party integrators); Link Verticals (Wallet/Access backends behind an Envoy gateway); the Identity Core backend with PostgreSQL and a Palm Verification Server behind the Palm Port; and external Social Auth, KYC, SMS, and Email provider ports.

1.2 Core Capabilities

All capabilities are available to every tenant and configured individually per tenant (§4.5 settings, §4.6 examples) — each tenant enables only what it needs:

  • Identity & auth — user management (platform-created or integrator-provided user_id); signup/login via OTP, email/password, Google, Apple; JWT sessions with refresh; account linking across methods.
  • Palm biometrics — enrollment (user_id + palm_template → stored mapping), verification (1:1) (user_id + scan → match + metadata), and identification (1:N) (scan → user_id).
  • KYC — pluggable providers (Nafath, Onfido, …), surfaced as status the product gates on — [POST-MVP], §6.
  • Devices — fleet pairing, mTLS, and revocation for pos/gate/kiosk/personal_scanner (§8), plus device-initiated palm transactions through the synchronous broker (§9).
  • Multi-tenancy & compliance — logical tenant isolation, consent management, DSR, and audit.

1.3 Integration Patterns

Products integrate two ways.

Pull — challenge-based (integrator-initiated). An integrator backend authenticates with OAuth client_credentials and creates a verify/enroll challenge; a paired personal scanner polls and completes it over mTLS; Identity verifies via the Palm Verification Server and returns the result plus a webhook. Full sequence: §7.4.1.

Pull flow: an integrator backend creates a verify or enroll challenge via OAuth client_credentials; the personal scanner polls and completes it over mTLS; Identity verifies through the Palm Verification Server and returns the result plus a webhook to the integrator.

Push — device-initiated (broker). An Identity-managed device (POS / gate / kiosk) scans over mTLS; Identity runs a 1:N identify, then the device-transaction broker calls the bound product's linked service authorize endpoint with a JWKS-verified identity_assertion and relays allow/deny back to the device in-band. Full sequence: §7.4.2; broker contract: §9.

Push flow: a POS or gate device scans a palm over mTLS; Identity runs a 1:N identify through the Palm Verification Server; the broker calls the linked service authorize endpoint with an identity_assertion JWT and relays the allow or deny decision back to the device in-band.