ComplyCube vs Stripe Identity

ComplyCube

A sandbox with its own key and scripted outcomes, a public OpenAPI spec, Markdown docs and an audit log API suit an agent running verification checks. Each environment has one unscoped key, no idempotency keys were found, and the only published terms are undated and read as website terms.

Stripe Identity

Stripe Identity runs on the Stripe API, with a public OpenAPI spec, idempotency keys, restricted keys for sensitive fields and a redact endpoint. The product page lists £1.25 per document and selfie check, and the first 50 are free. It has no watchlist or business screening, and outside GB, JP and the US it is in public beta.

ComplyCube

1. Send the key bare in the Authorization header, with no Bearer prefix. Keys start test_ or live_
2. Create a client first, then documents or live photos for it, then POST /v1/checks with the client and upload IDs
3. Stay under 10 requests a second live and 5 in the sandbox. On 429, back off exponentially with jitter, starting at 30 seconds
4. A badly formed filter returns 200 with no results, so check filter names before trusting an empty list
5. Checks are asynchronous. Subscribe to webhooks, verify the ComplyCube-Signature HMAC-SHA256 header, and expect duplicate and out-of-order events

Stripe Identity

1. Send an Idempotency-Key based on your user reference when creating a VerificationSession, so a retry doesn't make a second session
2. Send the end user the session URL or client secret. The person completes the check, the agent can't. Links expire after 48 hours
3. Use a restricted key for verified_outputs.dob and id_number. Without an IP restriction it reads them only for 48 hours
4. Wait for identity.verification_session.verified or requires_input webhooks instead of polling
5. Treat redact as irreversible, and don't put personal data in metadata