Back to Features
Biometric Verification
Face verification powered by Mercle OAuth. Ensure every member is a real human with liveness detection and face matching.
Overview
The verification system uses Mercle OAuth to authenticate users through biometric face verification. This prevents bots and fake accounts from joining your group.
When enabled, new members receive a verification prompt and must complete the OAuth flow within the configured timeout.
How It Works
- 1.User joins group or triggers /verify command
- 2.Bot generates OAuth URL with encrypted state (user ID, group ID, pending ID)
- 3.User clicks verification button and completes Mercle OAuth
- 4.Mercle performs liveness detection and face matching
- 5.On success, user is granted full group permissions
- 6.On timeout, configured action is taken (mute or kick)
Mini App Configuration
Open /app → Settings → Verification Settings
Verification Required
Toggle to require new members to verify their identity before participating.
Verification Timeout
How long users have to complete verification before action is taken:
1 minute3 minutes5 minutes10 minutes30 minutes
Default: 5 minutes (300 seconds)
Action on Timeout
What happens if user doesn't verify in time:
| Action | Behavior |
|---|---|
| mute | Restrict messaging (user stays in group but can't send messages) |
| kick | Remove from group (can rejoin and try again) |
Bot Commands
/verification onEnable verification requirement/verification offDisable verification requirement/verifyStart verification flow (for users)Security Features
- Liveness detection: Ensures user is present during verification
- Face matching: Compares face to stored identity
- One-time verification: Users only need to verify once
- Encrypted state: OAuth state contains encoded user/group context
- Privacy-first: Biometric data handled by Mercle, not stored by bot
Technical Details
- • OAuth Provider: Mercle SDK
- • State Encoding: Base64 JSON with user_id, group_id, pending_id, chat_id, message_id
- • Flow Types: "bot" (standard) or "mini_app" (from Mini App)
- • Pending Service: Tracks verification status in database
- • Permissions: Uses Telegram chat permissions API to restrict/unrestrict users