# Alloy (slim)

> Alloy is an identity and fraud decisioning platform for banks and fintechs. Its API runs onboarding journeys and evaluations that orchestrate identity, business, document and watchlist checks across third-party data vendors, with case management and ongoing monitoring.

- Full: https://www.anchorterminal.com/tools/alloy.md (~6,500 tokens) · this version ~1,580 tokens · JSON https://www.anchorterminal.com/tools/alloy.json · canonical https://www.anchorterminal.com/tools/alloy
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · Updated: 2026-10-14

**D · 52.4/100 · rank #782 of 1076 · #16 in Identity & business verification · not agent-ready · confidence medium**


Assessment: Alloy's public docs cover journeys, evaluations, entities, documents, cases and investigations, with llms.txt, Markdown pages, OpenAPI fragments and rate-limit headers with retry-after. Access is sales-led with no public price or trial, credentials have no scopes, there is no idempotency key or server SDK, and inputs vary by each customer's workflow.

## Facts

- Kind: HTTP API · vendor: First Mile Group, Inc. (Alloy) · category: Identity & business verification · legal entity: First Mile Group, Inc. · provenance 86/100
- Local only (HTTP): npm `@alloyidentity/web-sdk`
- Auth: OAuth or key · pricing: Paid · x402: no · licence: Proprietary service under Alloy's terms of service. The @alloyidentity/web-sdk capture package is MIT
- Probe metrics: not measured yet (probes haven't run)
- Surface graded: Alloy API v1 as documented on developer.alloy.com/public. No official MCP server found
- Base URLs: https://api.alloy.co and https://sandbox.alloy.co, or https://{account_slug}.api.alloy.com and .sandbox.alloy.com. Some accounts outside the US have their own hosts
- Resources: Journeys and journey applications, evaluations, entities and entity groups, documents, bank accounts, events, batches, custom lists, cases (deprecated) and investigations, AI analysis summaries, diagnostics
- Credentials: Token and secret as basic auth, or OAuth client credentials for a one-hour bearer token. Up to five secrets per key. IP allowlist
- Rate limits: Per endpoint, method, environment and account, no published figures. `alloy-ratelimit-limit`, `-remaining`, `-reset` and `retry-after` headers
- Errors: `status_code`, `error.minor_code`, `type`, `message`, `details`, `error_token`. 206 partial response resumable by PATCH. 429 minor code 4033
- Webhooks: 10-second timeout, ten retries over 24 hours, unordered and possibly duplicated, disabled after 100 failures in 72 hours
- SDKs: Web SDK @alloyidentity/web-sdk 2.16.0 and an Android web SDK for document capture. No server-side client
- Status: status.alloy.com on Statuspage with Production API, Sandbox API, Webhooks, SDK, Customer Dashboard and Third Party Data Integrations
- Certifications: SOC 2 Type 2 per the security page. Yearly third-party penetration tests. Disclosure by email

- Scores: Reliability 59, Performance pending, Schema & documentation 73, Agent ergonomics 52, Security & auth 49, Payments & pricing 0, Task success pending, Maintenance & community 72, Transparency & trust 62 · total over the 7 assessed categories
- Why: Reliability, Read with the hosted lines. · Schema & documentation, Each reference page embeds an OpenAPI 3.0.0 fragment titled Alloy API 1.0.0. No single downloadable spec file was found (20 of 25). · Agent ergonomics, No field selection, and evaluation and journey responses return the full decision payload (10 of 25). · Security & auth, An account-level token and secret sent as HTTP basic auth, or exchanged for a one-hour OAuth bearer token through client credentials. · Payments & pricing, Read with the hosted rubric. · Maintenance & community, Web SDK 2.16.0 on npm on 5 October 2026, and a product update posted on 23 September 2026 (30). · Transparency & trust, Closed service under published Terms of Service, which forbid robots, crawlers and scraping of the site or services, including to train AI s…
- Sources: 18, open questions: 5, both in the full twin
- Capabilities: kyc.identity, kyc.business, kyc.screening, kyc.documents, kyc.cases
- JSON: https://www.anchorterminal.com/api/v1/tools/alloy.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/alloy.svg` or a link to https://www.anchorterminal.com/tools/alloy from a page on alloy.com or one of its subdomains, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Get the account's base URL from the customer. Defaults are api.alloy.co and sandbox.alloy.co, and some accounts have their own hosts
2. Use unique, prefixed external IDs in sandbox. Sandbox and Production share one data store
3. Read `alloy-ratelimit-remaining`, and on 429 or 5xx wait for `retry-after` with exponential backoff and jitter
4. Expect `running` after about 25 seconds on journey applications and wait for the webhook instead of resubmitting
5. Send the workflow header with account-level keys, since inputs depend on the workflow configured

## Connect

```bash
curl -X POST https://sandbox.alloy.co/v1/oauth/bearer \
  -H "Content-Type: application/json" \
  -H "Authorization: Basic <basic_token>" \
  -d '{
    "grant_type": "client_credentials"
  }'
```
Full config and headless snippets are in the full page. Through letme (picks today, calling later): https://letme.dev/alloy

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| Didit | BB | 75 | kyc.identity, kyc.documents, kyc.screening, kyc.business, kyc.cases | https://www.anchorterminal.com/tools/didit.min.md |
| Persona | B | 69.5 | kyc.identity, kyc.business, kyc.documents, kyc.screening, kyc.cases | https://www.anchorterminal.com/tools/persona.min.md |
| Sumsub | B | 68.5 | kyc.identity, kyc.business, kyc.documents, kyc.screening, kyc.cases | https://www.anchorterminal.com/tools/sumsub.min.md |
| Socure RiskOS | B | 63.5 | kyc.identity, kyc.documents, kyc.screening, kyc.business, kyc.cases | https://www.anchorterminal.com/tools/socure-riskos.min.md |
| ComplyCube | B | 63.7 | kyc.identity, kyc.documents, kyc.screening, kyc.business | https://www.anchorterminal.com/tools/complycube.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)