ComplyAge
A rusted terminal on a workshop bench.

Privacy-first age verification

Developers

Three products, one integration record, test keys for staging. Everything is hosted — you never handle a selfie, an ID or a card number.

Create an integration

Integrating ComplyAge means creating an integration in the members portal, then adding one or more of: a script tag for the Age Gate, a JavaScript insert that opens the hosted verification window, and an OAuth/SSO flow for sign-in. Every integration has separate test and live key sets, so you can wire everything on staging and flip to live without code changes.

Guides

The Age Gate and SEO

Does an age gate hurt SEO? Why ComplyAge's overlay leaves your HTML — and your rankings — intact, plus guidance on bots, previews and Core Web Vitals.

The Age Gate

One script tag in <head>. It shields the page, calls the decision endpoint with your public key, and opens the verification window only in enforced regions. A signed pass cookie on your domain lets returning visitors through without a round-trip.
<script src="https://complyage.org/gate/v1/script.js?k=YOUR_PUBLIC_KEY"></script>

Hosted verification

The JavaScript insert exposes window.ComplyAge.verify(opts). Call it from a user gesture; it opens the hosted window as a popup, pins the message origin, and hands your callback the result — { status, method } — when the user finishes. Popup blocked? You get BLOCKED and can prompt the user to allow it.
<script src="https://verify.complyage.org/verify/v1/script.js"></script>
<script>
  document.getElementById('verify').onclick = function () {
    ComplyAge.verify({
      onResult: function (r) { console.log(r.status, r.method); }
    });
  };
</script>

OAuth / SSO

An OpenID Connect-style authorisation-code flow. Register a redirect URI, send the user to authorise, exchange the code server-side, then read userinfo and verification status. Verifications can be started inline if the user lacks one your integration requires.

Keys and environments

Each integration carries a test key set and a live key set. Test keys never bill and never mark a user as verified for live; swap the key when you go live. The public key in the gate script is safe to expose; client secrets and API keys are not.
  • Public key — in the Age Gate script tag; safe in HTML
  • Client id + secret — OAuth; secret stays on your server
  • Webhooks — configured per integration to receive verification events

Decision endpoint

The gate's decision is a plain GET you can also call yourself from a server — for example to gate an API response by region. It returns whether the region is enforced, the zone code, the minimum age and the allowed methods.
GET https://complyage.org/gate/v1/decide?k=YOUR_PUBLIC_KEY

Passes are verifiable offline

A gate pass is an Ed25519-signed token bound to your integration. The gate script verifies it in the browser with your public key (available at /gate/v1/pubkey), and your server can verify it the same way or call /gate/v1/pass/verify.

Quick start

  1. Create an account and an integration

    Sign up at members.complyage.org, create an integration for your site, and note the public key, client id and secret. Everything starts in test mode.

  2. Add the Age Gate

    Paste the script tag into <head> on a staging page and load it from an enforced region (or force a zone in the portal) to see the verification window.

  3. Add hosted verification where you need it

    Include the verify insert and call ComplyAge.verify from a button. Handle VERIFIED, DENIED, CANCELLED and BLOCKED in onResult.

  4. Add sign-in

    Wire the OAuth flow with your test client credentials; read verification status from the verifications endpoint.

  5. Go live

    Swap test keys for live keys in the portal. No code changes.

Frequently asked questions

Do I need a backend?
Not for the Age Gate or hosted verification — both are browser-only. OAuth's token exchange and any webhook receiver run on your server.
Is there an SDK?
The gate script and the verify insert are the SDK: dependency-free JavaScript served by ComplyAge. OAuth works with any standard client library.
Can I test without being billed?
Yes. Test keys never bill. Use them on staging and swap to live keys when you ship.
Does the gate work with my framework?
It is framework-agnostic: a script tag and a first-party cookie. React, Vue, Rails, WordPress — anything that serves HTML.