Sumsub vs Vouched

Sumsub

Per-token permissions, an IP allowlist, HMAC-signed requests and a public OpenAPI spec with Markdown docs suit an agent working on verification cases. No idempotency keys or Retry-After guidance were found, there is no server SDK, and production access needs a browser signup, a bank card and Sumsub's review of the integration.

Vouched

Vouched publishes per-transaction prices from $0.75 with a $300 monthly minimum and a 14-day trial, and its docs carry llms.txt, OpenAPI fragments and filterable job search. Rate limits have no number, there is no idempotency key, server SDK or security.txt, and the API status page shows a 70-minute rise in rejections on 1 October 2026.

Sumsub

1. Sign every request. X-App-Access-Sig is the lowercase hex HMAC-SHA256 of timestamp, uppercase method, path with query and raw body, and the timestamp must be within one minute of server time
2. Use a sandbox token (prefix sbx) for agent work. Sandbox and production tokens are separate, and Sumsub's own skills refuse any other prefix
3. Stay under 300 GET and 50 POST requests per 5 seconds, and under 500 new applicants per 24 hours in Sandbox
4. Token permissions can't be edited after creation. Generate a new token with the narrower set and delete the old one
5. Subscribe to the applicantReviewed webhook for results and verify x-payload-digest against the raw body before trusting it

Vouched

1. Use the private key in X-API-Key against verify.vouched.id or verify.eu.vouched.id, matching the account's region
2. Check Find Jobs before resubmitting. There is no idempotency key and each job is billed
3. Pass withPhotos=false and select fields on Find Jobs to keep responses small
4. In a test account, use the name test pass for a clean result and any other name for a failure
5. Back off on 429. All endpoints share one limit and no figure is published