Add palm verification to Privy with VeryAI integration

Big news: Privy app developers can now use VeryAI’s first-in-class palm biometrics to verify their users.

This integration will help app developers on Privy ensure that accounts and wallets are created by real people, not farmers, bots, or other malicious actors. When users register, they scan their palm with VeryAI’s proprietary biometrics system, ensuring each user is a real, unique person.

VeryAI can be integrated into a Privy app as a custom OAuth 2.0 provider, which takes approximately 10 minutes. It’s a simple four-step process: Register your Privy callback with VeryAI; Add VeryAI as a custom provider in Privy; Call login() from the Privy SDK; and Test.

Adding VeryAI to a Privy app not only strengthens sybil resistance for embedded wallets, but opens up new use cases. It stops malicious actors in their tracks; it simplifies verification at login; it can even be used to enable agentic commerce by linking agents to a trusted person. And for higher-risk actions, a separate Palm SDK integration can add in-the-moment liveness against the user’s enrolled Palm Model.

This integration promises to bring VeryAI’s safety, security, and smooth user experience to the Privy ecosystem.

What is the VeryAI Privy integration?

VeryAI is a tool that helps developers authenticate that their users are real people or their authorized agents using palm biometrics. It is 10x more accurate than Face ID, and protects user privacy with a zero-knowledge first architecture. VeryAI can be integrated into Privy apps as a custom OAuth provider.

Privy lets apps embed non-custodial crypto wallets behind logins like email or social accounts. With VeryAI support, you can go one step further and put these wallets behind VeryAI’s proprietary, privacy-enhancing palm biometrics. Unlike emails or social accounts, VeryAI proves that every account is owned by a real, unique person (and not a bot farm or a multi-account fraud ring).

How it works: Privy treats VeryAI as a custom OAuth 2.0 provider. First Privy handles callback and token exchange, before VeryAI returns a stable app-scoped sub value to identify the user. There’s no need for a custom bridge; the scope is limited to openid (and optional offline_access) so no PII enters the customer’s stack.

How do I add VeryAI palm verification to a Privy app?

Integrating VeryAI with Privy is a few simple steps. It takes approximately 10 minutes or less.

Before you get started, you’ll need a VeryAI application with a client_id and client_secret. If you don’t yet have access to the VeryAI developer portal, head here to get started.

You’ll also need a Privy app with access to custom OAuth providers.

To integrate:

Register the Privy callback within VeryAI. Head to the VeryAI developer portal and add the URI redirect. (You can find the most recent URI in the developer docs.) Then, copy the application’s client_id and client_secret.
Add VeryAI as a custom provider in Privy. Head to your Privy Dashboard. Then, under Settings > Login Method, select Add Custom Provider. Add VeryAI’s custom values, which can be found here.

Call login() from the Privy SDK. In your app, install Privy’s React SDK and wrap your application with PrivyProvider. To provision an Ethereum embedded wallet after login, enable automatic wallet creation:

npm install @privy-io/react-auth

import { PrivyProvider } from '@privy-io/react-auth';

export function Providers({ children }) {
  return (
    <PrivyProvider
      appId="your-privy-app-id"
      config={{
        embeddedWallets: {
          ethereum: {
            createOnLogin: 'users-without-wallets',
          },
        },
      }}
    >
      {children}
    </PrivyProvider>
  );
}

Once the custom provider is saved in Privy, it appears in Privy’s login modal.

Test the flow. Go to your application and select login with VeryAI. Complete the flow and make sure that Privy returns the correct user.

See the full instructions in the docs.

What problems does palm biometrics solve in Privy?

Sybil-resistance for embedded wallets

Creating embedded wallets (or accounts) is a major unlock for app developers; it allows them to easily distribute digital rewards and assets. But wallets themselves are fragile — they are extremely easy to create, and famously easy to lose control of due to social engineering or brute force hacks.

Many more traditional methods used to confirm wallet identity, such as linking to a social media account, only confirm that a wallet is linked to a specific account, not a specific person. And accounts can be compromised through identity theft and hacks, or used for reward farming or fraud.

With VeryAI’s palm biometrics, apps can verify that their embedded wallets belong to a real, unique user, and then reverify that the same user is taking an action. A simple palm scan stops hacks and farming in its tracks.

VeryAI enhances Privy’s passwordless wallet experience. Traditional account security measures don’t do much in the way of security: Email and SMS one-time passwords (OTPs) can be intercepted by malicious actors; stolen credentials are a leading breach vector; CAPTCHA can be solved by agents 100% of the time.

VeryAI’s palm biometrics works twofold: it links accounts to real users, and more importantly ensures that the same user is the one logging in.

Palms are an exceptionally secure, private, and accurate biometric identifier. They’re unique — even twins don’t have the same palm prints. They’re private — while one could easily do a targeted spoofing of a user with publicly available face data, there is no “Palmbook.” VeryAI has a 10⁻⁷ False Acceptance Rate per scan of just a single palm (scanning both palms, as VeryAI does during registration, makes it accurate enough to uniquely identify every person on Earth).

Most importantly, a VeryAI palm scan is quick for end users. Verification happens in seconds, instead of waiting on third-party apps like email servers, and never gets lost in spam filters.

Human ownership of agent wallets

There’s been a notable increase in consumer-focused agents, but the tools to deal with automated activity are stuck in the days of unauthorized scraping and spam. For apps, often it’s a binary choice between banning all agents and allowing them all.

Palm verification is at the heart of VeryAI’s Know Your Agent, an agent authentication tool that links agents to responsible users. A quick palm scan confirms that an agent is connected to a verified, real user; agents then verify again at key moments, such as surpassing a spending limit.

While Know Your Agent runs on its own flow and is not yet integrated directly with Privy, it is composable — an app can provision a wallet through Privy to an agent, while VeryAI attests the user.

Can I use VeryAI palm verification as MFA directly in Privy?

The VeryAI custom OAuth path for Privy covers registration and login; to use VeryAI as MFA, developers must use the Palm SDK.

The Privy Dashboard only natively offers passkeys, SMS, and TOTP as MFA methods, but VeryAI can also be used to verify that a user is in control of their account at the moment of action. All it requires is a separate integration with the Palm SDK.

Setting up the Palm SDK for reverification only takes a few minutes. Learn how to set up the Palm SDK in the docs.

Frequently asked questions

Do users need special hardware to use VeryAI?

No. VeryAI can be used on most modern smartphones, as long as it has a working camera. No external hardware needed!

Can the same person create two accounts in my app?

No. VeryAI links palm biometrics to specific users, and that identity is returned to you as a single stable sub value.

Are my palm scans private?

User privacy is a core design goal. The SDK derives a mathematical Palm Model from the palm capture. Biometric data is protected in transit and at rest, and Palm Models are stored in an isolated, encrypted biometric environment. In the standard integration, apps do not receive Palm Images or Palm Models; they receive a pseudonymous account identifier and limited verification metadata.

Read VeryAI’s trust and privacy information.

Does VeryAI share user data with my app?

Raw biometric data is not shared with any customer or stored long-term.

Why are palms a “stronger” biometric model than Face ID?

VeryAI’s palm biometrics are a uniquely strong and accurate identifier. They are naturally more private — there is far less publicly available palm data that can be fed into an LLM than there is face or fingerprint data, and palms cannot be as easily “lifted” or spoofed.

VeryAI is 10x more accurate than Face ID, which cannot tell the difference between identical twins, and more reliable than fingerprint scans, which fail when they get dirty. See more differences between VeryAI and Face ID or fingerprint.

How does VeryAI handle compliance and regulation?

VeryAI provides biometric authentication infrastructure rather than KYC decision-making and does not require government IDs for palm verification. Palm images are processed on-device into a mathematical Palm Model with capture-time liveness checks. The model is transmitted securely for validation and matching; enrolled models are stored in an isolated, encrypted biometric environment under our retention policy. Supported partner flows can then generate a zero-knowledge proof on-device so the partner receives only the proof or authorized verification result.

VeryAI is SOC 2 Type II, iBeta, and GDPR compliant.

Get started

Here’s what you need to get started with the VeryAI Privy integration:

VeryAI Developer Docs: Get Started
VeryAI Developer Docs: Privy Integration
VeryAI Developer Portal
Send questions to hello@very.org