Persona vs Shufti

Persona

The REST API has a public OpenAPI 3.1 file, llms.txt, API keys with per-resource permissions, idempotency keys on every POST and a 60-day sandbox trial with no card. Production needs a business review and a 12-month plan from $250 a month. The status page lists 11 incidents since 10 July 2026, including 70 minutes of timeouts across all products.

Shufti

One endpoint covers document, face, address, AML and KYB checks, with a free plan of 10 verifications a month, and a hosted MCP server adds OAuth with three scopes. No OpenAPI file, server SDK or idempotency key was found, and the status page history could not be read.

Persona

1. Ask for a dedicated key limited to the permissions the task needs. A new key has every standard permission until it's limited
2. Send Persona-Version on every call and an Idempotency-Key on every POST. A replayed key returns the first result, including a 500
3. Treat redact calls as irreversible. They permanently delete personal data and cascade to downstream objects
4. Stay under 300 requests a minute in production, read RateLimit-Remaining and Quota-Remaining, and back off on 429 because rejected requests still count
5. Use fields and include to cut response size. Through MCP these parameters aren't exposed, and only 14 tools take filter

Shufti

1. POST every verification to https://api.shuftipro.com/ with a unique reference of 6 to 250 characters and one object per service. Read results from /status with that reference
2. Register the callback domain in the back office first. An unregistered callback_url is rejected
3. Stay under 60 requests a minute per IP on a production account and 20 on a trial account
4. Check the Signature response header. Accounts created after 15 March 2023 hash the Secret Key with SHA-256 before appending it to the raw response
5. Through MCP, identity checks return a verification_url for the person to open. No tool accepts an image, so use the REST API for offsite proofs