ComplyCube vs Persona

ComplyCube

A sandbox with its own key and scripted outcomes, a public OpenAPI spec, Markdown docs and an audit log API suit an agent running verification checks. Each environment has one unscoped key, no idempotency keys were found, and the only published terms are undated and read as website terms.

Persona

The REST API has a public OpenAPI 3.1 file, llms.txt, API keys with per-resource permissions, idempotency keys on every POST and a 60-day sandbox trial with no card. Production needs a business review and a 12-month plan from $250 a month. The status page lists 11 incidents since 10 July 2026, including 70 minutes of timeouts across all products.

ComplyCube

1. Send the key bare in the Authorization header, with no Bearer prefix. Keys start test_ or live_
2. Create a client first, then documents or live photos for it, then POST /v1/checks with the client and upload IDs
3. Stay under 10 requests a second live and 5 in the sandbox. On 429, back off exponentially with jitter, starting at 30 seconds
4. A badly formed filter returns 200 with no results, so check filter names before trusting an empty list
5. Checks are asynchronous. Subscribe to webhooks, verify the ComplyCube-Signature HMAC-SHA256 header, and expect duplicate and out-of-order events

Persona

1. Ask for a dedicated key limited to the permissions the task needs. A new key has every standard permission until it's limited
2. Send Persona-Version on every call and an Idempotency-Key on every POST. A replayed key returns the first result, including a 500
3. Treat redact calls as irreversible. They permanently delete personal data and cascade to downstream objects
4. Stay under 300 requests a minute in production, read RateLimit-Remaining and Quota-Remaining, and back off on 429 because rejected requests still count
5. Use fields and include to cut response size. Through MCP these parameters aren't exposed, and only 14 tools take filter