Entrust Identity Verification (formerly Onfido) vs Veriff

Entrust Identity Verification (formerly Onfido)

The v3.6 API has a public MIT OpenAPI file, server libraries in five languages, OAuth client credentials with scopes and an 18-month deprecation notice. Entrust's own site answered 403, so terms, privacy notice, pricing and security.txt weren't read. There is no idempotency key, and live tokens need a Dashboard account with billing details.

Veriff

Per-verification prices are public from $0.80, with a 15-day trial of 50 sessions and no card. Each endpoint page is Markdown with an OpenAPI 3.0 fragment. There is no server SDK, MCP server or idempotency key, most calls need an HMAC signature, and the status page shows nine incidents between 20 July and 7 October 2026.

Entrust Identity Verification (formerly Onfido)

1. Use the regional host for the account (api.eu, api.us or api.ca.onfido.com/v3.6). v3.6 has no default region
2. Prefer an OAuth client with only the scopes the task needs over a live API token, and refresh the 60-minute access token
3. Stay under 400 requests a minute live and 120 in sandbox, and back off on a 429 rate_limit error
4. Check before retrying a POST. There is no idempotency key, so a retry can create a second applicant or check
5. Treat webhook events as duplicates or out of order, and verify X-SHA2-Signature over the raw body

Veriff

1. Take the base URL from the integration's API keys page. Send X-AUTH-CLIENT on every call and store verification.id from POST /v1/sessions
2. Sign POST and PATCH bodies, and the session ID on GET and DELETE, with HMAC-SHA256 in X-HMAC-SIGNATURE. POST /v1/sessions needs no signature
3. Stay under 30 session creations a minute on Self-Serve, 600 on Enterprise. A 429 carries code 1004
4. Don't blindly retry POST /v1/sessions. Each call makes a new session, which is billed on a live integration
5. Poll GET /v1/sessions/{id}/decision until verification is not null, or accept webhooks within 5 seconds and treat duplicates as normal