sierrafy v0.1.0 · phase 1
Open source · MIT · built in Sierra Leone

Identity verification for Sierra Leone, built in the open.

An SDK for checking Sierra Leonean eID cards and passports. NIN validation and document OCR work today; face matching, fraud signals and NFC chip reading are next. Self-hosted and works offline.

npm install @sierrafy/sdk
Read the docs Architecture spec →
POST /v1/verifyprocessing…
{
"status": "SCANNING",
"confidence_score": …,
"name": …,
"nin": …,
"dob": …,
"face_match_score": …,
"nfc_chip_read": …,
"fraud_signals": …
}
// how it works

Five checks, each one more certain than the last.

Nearly everyone in Sierra Leone has a NIN. Sierrafy gives you the checks to use it. Run one or all five, and set your own pass, review and fail thresholds.

  1. 01
    NIN formatPOST /v1/validate-ninin the SDK

    The NIN is 8 uppercase letters and digits, with no typos, stray spaces or known test values. Runs instantly, before any upload.

    ConfidenceLow
  2. 02
    Document OCRPOST /v1/ocrexperimental

    Reads the NIN, name and date of birth from the eID card or passport (including the MRZ) and checks them against what the user typed.

    ConfidenceMedium
  3. 03
    Face matchPOST /v1/face-matchin development

    The person in the selfie is the person on the card. Nothing is stored.

    ConfidenceMedium–high
  4. 04
    Fraud signalspart of /v1/verifyin development

    Flags edited images, photos of screens, reused NINs, expired documents and altered fonts.

    ConfidenceHigh
  5. 05
    NFC chip readPOST /v1/nfc-verify · mobilein development

    Reads the data stored on the card's chip and checks it against the printed card. With NCRA's root certificate, it also confirms the chip data hasn't been altered.

    ConfidenceVery high
  6. 06
    Live registry lookupphase 2 · with NCRA partnership

    Confirms the NIN is active in the national registry. This one isn't built yet: it depends on a partnership with NCRA.

    not in phase 1

note · The HTTP endpoints above arrive with the self-hosted gateway. Today checks 01 and 02 run as library calls, shown in the quickstart below.

note · Chip reading is not built yet. When it is, verifying the chip's signature will still need NCRA's CSCA certificate. Until that exists, passive_auth_passed returns null, not a pass.

// quickstart

One call. A result you can branch on.

Install the SDK and validate a NIN offline, with no server and no account. The self-hosted gateway and the Python, PHP, React Native and Flutter SDKs follow in later milestones.

  • Runs offline, no server and no account
  • Never stores selfies, card photos or face data
  • Format rules live in editable JSON, not in code
verify.ts 
import { validateNin } from '@sierrafy/sdk/nin';

const result = validateNin(form.nin);

// {
//   valid: true,
//   nin: 'K7M2QX4P',
//   checks: { length: true, charset: true,
//             checksum: true, blacklist: true }
// }

if (!result.valid) {
  // INVALID_LENGTH | INVALID_CHARSET | BLACKLISTED
  return reject(result.error);
}

// Structural only. This does not mean the NIN
// is registered with NCRA.
onboard(user);
Thresholds below apply to the full /v1/verify flow, once the gateway ships. → PASS · proceed → REVIEW · manual check → FAIL · reject