LAMP.AR / SCRIPTS

Overage

Camera age checks. One line of code. Visitors look at the camera for about five seconds and turn their head slightly. Our model estimates age and hands your site the result as a signed token.

Try it now How to embed

Live demo

Try it on your face

The camera only turns on with your permission. No photos are stored.

How it works

Five seconds

Camera
The widget takes 8 frames: looking straight and turning the head. That makes printed-photo tricks harder.
Estimate
On our EU server a face detector and an age model return a result in seconds. Frames are dropped from memory right away.
Token
If the estimate clears the threshold, your site gets an Ed25519-signed JWT that your server verifies.

Embed

Two steps

1. Add the script to your site

<!-- YOUR_SITE_KEY: copy it from https://lamp.ar/dashboard. The widget works only on the addresses you list there. -->

<!-- Ask for the check, then verify the token on your server (step 2): the page stays protected even without JavaScript -->
<script src="https://lamp.ar/overage.js" data-site-key="YOUR_SITE_KEY"></script>
<script>
  // result: { result: "pass", token } | { result: "fail" } | { result: "cancelled" }
  AgeGate.verify().then(function (r) {
    if (r.result === "pass") {
      fetch("/api/age-verified", { method: "POST", body: r.token });  // verify on your server
    }
  });
</script>

2. Verify the token on your server

// npm i jose
import { createRemoteJWKSet, jwtVerify } from "jose";

const JWKS = createRemoteJWKSet(new URL("https://lamp.ar/.well-known/jwks.json"));

export async function isAdult(token) {
  const { payload } = await jwtVerify(token, JWKS, {
    issuer: "https://lamp.ar",
    audience: "YOUR_SITE_KEY",
  });                               // also checks the signature and expiry (10 minutes)
  return payload.age_over >= 18;   // then set your own session cookie
}

Never trust the browser result alone: always verify the token server-side. Public keys: https://lamp.ar/.well-known/jwks.json

Ready-made server protection (cookie, one-time tokens, gate page) for Node.js, NestJS, PHP, Laravel, WordPress, FastAPI, Django, .NET, Go and Java is in your dashboard, under each site's “Server protection”: lamp.ar/dashboard

Privacy

We keep no photos

Photos stored

Frames are processed in memory and deleted as soon as we answer.

EU server

The service runs in Germany, in an EU data centre.

Only the threshold

The token carries only “18+”, never the age, a name or a photo.

Pricing

Plans

Pricing is agreed with each company: volume, invoice billing and an SLA. Write to us and we’ll make you an offer.

Custom

Large volume, invoice billing, on-premise option and an SLA.

Limits

Straight talk

This is age estimation, not identity verification. The model's average error is a few years, so the default threshold is 21.
The head-turn check stops printed photos, not video replays or masks.
On “fail” the widget offers a check with a passport or ID card, after the visitor agrees: we use only the date of birth (an expired document will do), compare the photo with the face and store nothing. A computer without a camera hands over to the phone with a QR code. It cannot spot a forged document, so where the law requires certified verification, use a provider that does that.