Stop making users choose between security and convenience. Give them both: add FaceLogon to your site with one line of code. No forgotten passwords. No reset emails. No SMS codes. No login friction.
300 sign-ins a month, free.
Everything else is a setting in your dashboard, so the code on your site never has to change again.
One tag in your page, wherever your sign-in button lives. Works with WordPress, WooCommerce, custom sites, and anything else that lets you edit HTML.
Face on its own, or face plus a name, a phone number, or a password. Change your mind later without touching your site.
Every sign-in, every failure, every returning face lands in your dashboard. Send them to your own system too, if you have one.
Signing up and signing in are two different settings. Collect what you need on the first visit, then decide how much of it someone has to prove every time they come back.
Asked once, the first time someone arrives.
What they prove when they come back.
You can only ask for something at sign-in that you collected at sign-up, so ticking one here ticks the other for you.
The widget handles the camera, the states and the retries. Your server does one HTTP call to confirm what happened.
<!-- anywhere before </body> --> <script src="https://www.facelogon.com/widget.js" data-app="fl_live_8x2kq4m"></script> // What you ask for lives in your dashboard, not here, // so nobody can edit this page to ask for less. <!-- your own button, styled however you like --> <button data-facelogon="signin"> Sign in with your face </button>
// Fires in the browser. Use it for your interface only. FaceLogon.on('signedin', function (e) { // e.code, short-lived, send this to your server fetch('/session', { method: 'POST', body: JSON.stringify({ code: e.code }) }); }); FaceLogon.on('failed', function (e) { // e.reason: no_match | liveness | camera_denied | timeout showMessage(e.reason); });
// On your server. This is the only result you should trust. const r = await fetch('https://api.facelogon.com/v1/verify', { method: 'POST', headers: { Authorization: 'Bearer ' + FACELOGON_SECRET }, body: JSON.stringify({ code }) }); const user = await r.json(); // { user_id: "flu_9f2a…", is_new: false, // factors_proven: ["face", "password"], // signed_in_at: "2026-07-31T…" } // Check this against what YOU require for the action. if (!user.factors_proven.includes('password')) return deny();
// Optional. Paste any URL in your dashboard: // your server, Zapier, Make, or a Google Sheet. POST /your-endpoint FaceLogon-Signature: t=1785…,v1=… { "type": "user.signedin", "user_id": "flu_9f2a…", "is_new": false, "created": 1785312000 }
Add FaceLogon with a few lines of code. No authentication infrastructure to build, no biometric expertise required.
Your application only needs to verify the result. FaceLogon handles the authentication flow, so your front end stays clean and your back end remains in control.
The camera is accessed securely from FaceLogon, not from your website. Your application never receives the video stream or requests camera permissions directly.
Authentication policies are enforced on our servers, not in your page. Users can't weaken security by modifying your site's HTML or JavaScript.
Verification codes are single-use, expire in 60 seconds, and are tied to the page that requested them, reducing replay and interception risks.
Manage trusted domains, authentication policies, session duration and security rules from the dashboard without changing your application code.
See who signed in, who needs help, and who hasn't returned. Unlock accounts, review activity, and keep your user base organised, all from one simple dashboard.
dashboard.facelogon.comOne number decides your plan: how many successful sign-ins you have in a month.
A sign-in is one successful face check. Setting a face up the first time is free, and failed attempts are never counted. Go over your limit and we email you. Nothing switches off mid-month.
No. Nothing is kept that could be turned back into a face. No photographs, no face templates. Each sign-in works out a key from the live camera view and then discards it.
This matters for more than privacy. There is no store of faces to leak, so a breach of us does not expose your users.
Bad light, a new beard, a cracked camera. It happens. Every site sets a way through before going live: a code to their email, a handoff to your existing login, or a queue you approve by hand.
Nobody gets stuck, and you do not get the support email.
Not for the main sign-in, and we would rather say so up front. Both platforms run their own login and only let outside providers replace it on their enterprise plans.
FaceLogon works today on WordPress and WooCommerce, on custom-built sites, and anywhere else you control your own pages.
It depends what is behind the door. Face on its own is one factor and a determined lookalike is a real risk, so it suits saving preferences, members areas and loyalty perks.
For anything with money or personal records behind it, add a password. That gives you two factors and still asks your users for nothing about themselves.
Yes. Face data is treated as sensitive in most places, including Australia, the EU and several US states, so your privacy policy needs a line about it and your users need to agree before their first sign-in.
The widget asks for that agreement and records it. The wording is yours to edit in the dashboard.
You choose, and you can let your users choose too. Anything from thirty days to two years, counted from the last time they signed in.
When it lapses, their setup is deleted and they are simply invited to do it again next visit.
300 sign-ins a month, free, for as long as you like.
Try for free