A person receiving mail at that address completed this exact card. With email binding: the same party also controls the account’s email.
A personhood check by U.S. mail
We mail yourusers POST cards.
POST Request mails a single-use QR code to a U.S. address. When your user scans it and confirms, a signed webhook tells you they (probably) aren’t an AI (for now).
- Rates from
- $0.75 / attempt
- Standard schedule
- 5–7 business days
- Recipient names
- Never collected
What your users see
A card. A scan. A stamp.
- 01 / Delivery
A POST card arrives
It carries a private, single-use QR code on the message side.
- 02 / Verification
They scan and confirm
The QR code opens a short verification page. Email-bound cards also ask for the code sent to their account.
- 03 / Return
Signed and returned
They see the green VERIFIED postmark. Your server receives the signed webhook.
FORM PR-01 / COPY B- XCard delivered
- XCredential opened
- XVerification completed
- Card
- ...7F3A
- Binding
- Email OTP
- Event
- verification.verified
The delivery loop
One request. One physical checkpoint.
One API call sends the card. One webhook tells you it was received and confirmed.
- 01
Submit an address
Your server sends a domestic mailing address. We validate it, debit your postage balance, and create a single-use credential. Recipient names are not accepted.
POST /v1/verifications - 02
We print and mail
We print the card and hand it to the Postal Service. The QR code prints on the private side, never the side that shows the address.
PRINTED -> IN TRANSIT - 03
Your user closes the loop
They scan the card and confirm receipt. Email-bound cards also require the account code. We sign a webhook when complete.
verification.verified
Legal identity, one-human uniqueness, permanent residence, or continued control of the address after verification.
Fraud resistance
Make fake accounts expensive.
Every attempt now needs a deliverable address, postage, and several days.
A physical step for every attempt
Each verification requires a card sent through the U.S. mail.
Pair the card with email
If you enable email binding, your user confirms with the card and a code sent to their account.
One card, one completion
The route expires when the verification is complete. The same card cannot be used for another account.
Records schedule
Every record has a schedule.
The Postal Service does not keep a copy of your mail. Neither do we. Addresses stay encrypted for 90 days after a verification ends, then move to a vault with no link to any account. The verification keeps a redacted line and a fingerprint — enough to spot reuse, not to recover the address.
Read the data lifecycle| Record | Plaintext window | After purge |
|---|---|---|
| Mailing address (encrypted) | Terminal state + 90 days | Moves to delinked vault |
| Delinked address vault | 18 months | Encrypted / week-level dates |
| Redacted address + fingerprint | Permanent | Retained with verification |
| Email (encrypted) | Terminal state + 90 days | Hash + mask remain |
| External ID + metadata | Permanent | Customer supplied |
| Recipient name | Never collected | None |
| QR credential | Plaintext never stored | Hash only |
Domestic rates / July 2026
Postage, not seats.
Prepay a dollar balance. Each mailpiece debits its rate. Credits do not expire.
| Class | Format and schedule | Rate |
|---|---|---|
| Bulk | Postcard / batched weekly / 2–3 weeks | $0.75 |
| Standard Default | Postcard / mailed next day / 5–7 business days | $1.25 |
| Certified | Sealed letter / mailed next day | $3.00 |
Integration
A request now. Proof later.
Test mode completes the same loop without buying postage. Move to a live key when the webhook is wired.
curl https://postrequest.dev/api/v1/verifications \
-H "Authorization: Bearer pr_live_..." \
-d '{
"address": {
"line1": "1600 EXAMPLE ST",
"city": "SEATTLE",
"state": "WA",
"zip": "98101"
},
"class": "standard",
"external_id": "user_8123"
}'{
"type": "verification.verified",
"id": "01JZ3NVJ4M8Q",
"external_id": "user_8123",
"status": "verified",
"verified_at": "2026-07-17T15:02:11Z",
"binding": "email_otp"
}Test mode uses simulated mail
