# Alloy vs Shufti

> Shufti scores 57.8 (C) to Alloy's 52.4 (D) for identity verification. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/alloy-vs-shufti
- Markdown: https://www.anchorterminal.com/compare/alloy-vs-shufti.md (~2,500 tokens)
- Slim: https://www.anchorterminal.com/compare/alloy-vs-shufti.min.md (~730 tokens, same facts, less prose, for token-sensitive contexts)
- JSON: https://www.anchorterminal.com/compare/alloy-vs-shufti.json (this page as data, same URL with Accept: application/json)
- Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- Updated: 2026-10-14

Shufti scores 57.8 (C) on agent readiness against Alloy's 52.4 (D), and leads in 4 of 7 scored categories. Alloy leads on schema & documentation and agent ergonomics. Both do identity verification.

- Alloy: grade D, 52.4/100, rank #782 of 1076. Markdown https://www.anchorterminal.com/tools/alloy.md · JSON https://www.anchorterminal.com/api/v1/tools/alloy.json
- Shufti: grade C, 57.8/100, rank #631 of 1076. Markdown https://www.anchorterminal.com/tools/shufti.md · JSON https://www.anchorterminal.com/api/v1/tools/shufti.json
- Best identity and business verification APIs for AI agents: https://www.anchorterminal.com/best/identity-verification/index.md
- All 119 verification comparisons: https://www.anchorterminal.com/compare/identity-verification/index.md

## Which one, for what

### Alloy (D)

Good for: Banks and fintechs that already run onboarding through Alloy and want an agent to submit journey applications, read decisions and work investigations.

Ahead on:
- Schema & documentation, 73 against 58
- Agent ergonomics, 52 against 47

Watch for: No public prices, trial or self-serve sign-up. Access starts with a demo request

### Shufti (C)

Good for: A team that wants document, face, address, AML and KYB checks behind one endpoint, a free plan for low volume, and an MCP server that hands the person a hosted verification link.

Ahead on:
- Reliability, 65 against 59
- Security & auth, 62 against 49
- Payments & pricing, 35 against 0
- Transparency & trust, 71 against 62

Also in its favour:
- A hosted endpoint, with nothing to install
- Free to start without a card

Watch for: No OpenAPI file or other machine-readable contract was found. The reference is prose tables plus Postman collections


## Score by category

| Category | Weight | Alloy | Shufti | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 59 | 65 | Shufti +6 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 73 | 58 | Alloy +15 |
| Agent ergonomics | 13% (16.2 this run) | 52 | 47 | Alloy +5 |
| Security & auth | 14% (17.5 this run) | 49 | 62 | Shufti +13 |
| Payments & pricing | 10% (12.5 this run) | 0 | 35 | Shufti +35 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 72 | 72 | even |
| Transparency & trust | 7% (8.8 this run) | 62 | 71 | Shufti +9 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **52.4 · D** | **57.8 · C** | |

## Facts side by side

| Fact | Alloy | Shufti |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | First Mile Group, Inc. (Alloy) | Shufti Pro Limited |
| Hosted endpoint | no (local only) | `https://api.shuftipro.com` |
| Transports | HTTP | HTTP, Streamable HTTP |
| Auth | OAuth or key | OAuth or key |
| Pricing | Paid | Freemium |
| x402 | no | no |
| Licence | Proprietary service under Alloy's terms of service. The @alloyidentity/web-sdk capture package is MIT | Proprietary service under Shufti's Terms and Conditions. The licences of the mobile capture SDKs were not checked |
| Tools exposed | none | 25 |
| Read-only variant documented | no | no |
| llms.txt | yes | yes |
| Last release | 2026-10-05 | 2026-10-06 |
| Terms last updated | 2026-03-12 |  |
| Privacy policy last updated | no date given | 2026-09-01 |
| Customer content may train models | not found in the text | yes, with an opt-out |
| Terms restrict automated access | yes |  |
| Terms restrict benchmarking | not found in the text |  |
| Terms or service can change without notice | not found in the text |  |
| Arbitration or class-action waiver | yes |  |
| Popularity | 21k npm/wk | 673 npm/wk |

## Verdicts

**Alloy.** Alloy's public docs cover journeys, evaluations, entities, documents, cases and investigations, with llms.txt, Markdown pages, OpenAPI fragments and rate-limit headers with retry-after. Access is sales-led with no public price or trial, credentials have no scopes, there is no idempotency key or server SDK, and inputs vary by each customer's workflow.

**Shufti.** One endpoint covers document, face, address, AML and KYB checks, with a free plan of 10 verifications a month, and a hosted MCP server adds OAuth with three scopes. No OpenAPI file, server SDK or idempotency key was found, and the status page history could not be read.

## Before you call either

### Alloy

1. Get the account's base URL from the customer. Defaults are api.alloy.co and sandbox.alloy.co, and some accounts have their own hosts
2. Use unique, prefixed external IDs in sandbox. Sandbox and Production share one data store
3. Read `alloy-ratelimit-remaining`, and on 429 or 5xx wait for `retry-after` with exponential backoff and jitter
4. Expect `running` after about 25 seconds on journey applications and wait for the webhook instead of resubmitting
5. Send the workflow header with account-level keys, since inputs depend on the workflow configured

### Shufti

1. POST every verification to `https://api.shuftipro.com/` with a unique `reference` of 6 to 250 characters and one object per service. Read results from `/status` with that reference
2. Register the callback domain in the back office first. An unregistered `callback_url` is rejected
3. Stay under 60 requests a minute per IP on a production account and 20 on a trial account
4. Check the `Signature` response header. Accounts created after 15 March 2023 hash the Secret Key with SHA-256 before appending it to the raw response
5. Through MCP, identity checks return a `verification_url` for the person to open. No tool accepts an image, so use the REST API for offsite proofs

## Questions

### Which is better for AI agents, Alloy or Shufti?

Shufti scores 57.8 (C) on agent readiness against Alloy's 52.4 (D), and leads in 4 of 7 scored categories. Alloy leads on schema & documentation and agent ergonomics.

### Do Alloy and Shufti need an API key?

Both take an API key or an OAuth sign-in.

### Can an agent call Alloy and Shufti without installing anything?

No hosted endpoint is listed for Alloy. Shufti has a hosted endpoint at https://api.shuftipro.com.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/alloy-vs-shufti.json, and with the fewest tokens: https://www.anchorterminal.com/compare/alloy-vs-shufti.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "alloy", "b": "shufti"}`. From a terminal: `anchor compare alloy shufti`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/alloy.json and https://www.anchorterminal.com/api/v1/tools/shufti.json

## Other comparisons with Alloy or Shufti

- [Alloy vs ComplyCube](https://www.anchorterminal.com/compare/alloy-vs-complycube.md)
- [Alloy vs Didit](https://www.anchorterminal.com/compare/alloy-vs-didit.md)
- [Alloy vs Entrust Identity Verification (formerly Onfido)](https://www.anchorterminal.com/compare/alloy-vs-entrust-identity-verification.md)
- [Alloy vs Jumio](https://www.anchorterminal.com/compare/alloy-vs-jumio.md)
- [Alloy vs Middesk](https://www.anchorterminal.com/compare/alloy-vs-middesk.md)
- [Alloy vs Persona](https://www.anchorterminal.com/compare/alloy-vs-persona.md)
- [Alloy vs Plaid Identity Verification](https://www.anchorterminal.com/compare/alloy-vs-plaid-identity-verification.md)
- [Alloy vs Socure RiskOS](https://www.anchorterminal.com/compare/alloy-vs-socure-riskos.md)
- [Alloy vs Stripe Identity](https://www.anchorterminal.com/compare/alloy-vs-stripe-identity.md)
- [Alloy vs Sumsub](https://www.anchorterminal.com/compare/alloy-vs-sumsub.md)
- [Alloy vs Trulioo](https://www.anchorterminal.com/compare/alloy-vs-trulioo.md)
- [Alloy vs Veriff](https://www.anchorterminal.com/compare/alloy-vs-veriff.md)
- [Alloy vs Vouched](https://www.anchorterminal.com/compare/alloy-vs-vouched.md)
- [ComplyCube vs Shufti](https://www.anchorterminal.com/compare/complycube-vs-shufti.md)
- [Didit vs Shufti](https://www.anchorterminal.com/compare/didit-vs-shufti.md)
- [Entrust Identity Verification (formerly Onfido) vs Shufti](https://www.anchorterminal.com/compare/entrust-identity-verification-vs-shufti.md)
- [Jumio vs Shufti](https://www.anchorterminal.com/compare/jumio-vs-shufti.md)
- [Persona vs Shufti](https://www.anchorterminal.com/compare/persona-vs-shufti.md)
- [Plaid Identity Verification vs Shufti](https://www.anchorterminal.com/compare/plaid-identity-verification-vs-shufti.md)
- [Shufti vs Socure RiskOS](https://www.anchorterminal.com/compare/shufti-vs-socure-riskos.md)
- [Shufti vs Stripe Identity](https://www.anchorterminal.com/compare/shufti-vs-stripe-identity.md)
- [Shufti vs Sumsub](https://www.anchorterminal.com/compare/shufti-vs-sumsub.md)
- [Shufti vs Trulioo](https://www.anchorterminal.com/compare/shufti-vs-trulioo.md)
- [Shufti vs Veriff](https://www.anchorterminal.com/compare/shufti-vs-veriff.md)
- [Shufti vs Vouched](https://www.anchorterminal.com/compare/shufti-vs-vouched.md)
- [Alloy vs ComplyAdvantage](https://www.anchorterminal.com/compare/alloy-vs-complyadvantage.md)
- [ComplyAdvantage vs Shufti](https://www.anchorterminal.com/compare/complyadvantage-vs-shufti.md)
- [Middesk vs Shufti](https://www.anchorterminal.com/compare/middesk-vs-shufti.md)