@notmypii/sdk

Age verification via ECG — no ID, no face scan, nothing stored. Users take a 30-second ECG on Apple Watch; the result is returned as a signed RS256 JWT.

Install

npm install @notmypii/sdk

Get an API key

Sign up at notmypii.com to get your pk_live_... API key.

Server-side usage (Node.js / Edge)

import { NMPClient } from '@notmypii/sdk';

const nmp = new NMPClient({ apiKey: process.env.NMP_API_KEY! });

// 1. Create a session and redirect the user to the App Clip
const session = await nmp.createSession({
  redirectUri: 'https://yoursite.com/callback',
});
res.redirect(session.clipLinkUrl); // no install required

// 2. In your /callback handler — exchange the code for a verified result
const result = await nmp.verify(req.query.code);

if (result.isAdult) {
  // grant access
} else {
  // route to fallback
}

result shape:

{
  isAdult: boolean;           // true when age_class === 'adult' and confidence is high
  payload: {
    age_class: 'adult' | 'not_adult';
    age_verified: boolean;
    confidence: number;       // 0–1
    session_id: string;
    partner: string;
    iat: number;
    exp: number;
  };
  jwt: string;                // raw RS256 JWT — verify independently via /v1/jwks
}

Browser modal (CDN / Vite)

Drop-in modal — no framework required:

import { openVerifyModal, parseCallback } from '@notmypii/sdk';

// Trigger the modal
document.getElementById('verify-btn')!.onclick = () =>
  openVerifyModal({
    apiKey: 'pk_live_...',
    redirectUri: window.location.href,
  });

// On page load — handle the return redirect
const cb = parseCallback();
if (cb) {
  // cb.code is ready to send to your server for exchange
}

React

import { VerifyAgeButton, useNMPVerify } from '@notmypii/sdk/react';
import { useRouter } from 'next/navigation';

// Drop-in button
export default function Page() {
  const router = useRouter();
  return (
    <VerifyAgeButton
      apiKey={process.env.NEXT_PUBLIC_NMP_API_KEY!}
      redirectUri="https://yoursite.com/callback"
      onVerified={(result) => {
        if (result.isAdult) router.push('/protected');
      }}
    />
  );
}

// Or use the hook directly
function AgeGate() {
  const { verify, result, loading, error } = useNMPVerify({
    apiKey: process.env.NEXT_PUBLIC_NMP_API_KEY!,
    redirectUri: 'https://yoursite.com/callback',
    onVerified: (result) => console.log(result.isAdult),
  });

  return <button onClick={verify} disabled={loading}>Verify Age</button>;
}

JWT verification (independent)

// Fetch the public key and verify the JWT offline
const jwks = await nmp.fetchJwks();
// Use a library like `jose` to verify against the JWKS

JWKS endpoint: https://api.notmypii.com/v1/jwks

Next.js App Router example

See examples/nextjs-app-router.ts for a complete server + client integration.

Privacy

ECG signals are processed on-device. The API receives only the classification result and confidence score — no raw waveform data, no personal identifiers.