Stripe Identity vs Veriff

Stripe Identity

Stripe Identity runs on the Stripe API, with a public OpenAPI spec, idempotency keys, restricted keys for sensitive fields and a redact endpoint. The product page lists £1.25 per document and selfie check, and the first 50 are free. It has no watchlist or business screening, and outside GB, JP and the US it is in public beta.

Veriff

Per-verification prices are public from $0.80, with a 15-day trial of 50 sessions and no card. Each endpoint page is Markdown with an OpenAPI 3.0 fragment. There is no server SDK, MCP server or idempotency key, most calls need an HMAC signature, and the status page shows nine incidents between 20 July and 7 October 2026.

Stripe Identity

1. Send an Idempotency-Key based on your user reference when creating a VerificationSession, so a retry doesn't make a second session
2. Send the end user the session URL or client secret. The person completes the check, the agent can't. Links expire after 48 hours
3. Use a restricted key for verified_outputs.dob and id_number. Without an IP restriction it reads them only for 48 hours
4. Wait for identity.verification_session.verified or requires_input webhooks instead of polling
5. Treat redact as irreversible, and don't put personal data in metadata

Veriff

1. Take the base URL from the integration's API keys page. Send X-AUTH-CLIENT on every call and store verification.id from POST /v1/sessions
2. Sign POST and PATCH bodies, and the session ID on GET and DELETE, with HMAC-SHA256 in X-HMAC-SIGNATURE. POST /v1/sessions needs no signature
3. Stay under 30 session creations a minute on Self-Serve, 600 on Enterprise. A 429 carries code 1004
4. Don't blindly retry POST /v1/sessions. Each call makes a new session, which is billed on a live integration
5. Poll GET /v1/sessions/{id}/decision until verification is not null, or accept webhooks within 5 seconds and treat duplicates as normal