KYC & Identity Verification APIs (2026)

The best KYC or identity verification API for a developer is one you can test, steer, price, and launch on your own. Four checks measure that: self-serve test access, documented test outcomes, launch without a sales call, and a published per-check price. As of October 15, 2026, only Didit, iDenfy, Stripe Identity, and Sumsub pass all four, so start there.

The launch check is the one that moves your schedule. Of the 14 vendors compared here, five publish no way to reach live traffic without a sales call and three leave that path incomplete. If you pick one of those eight, an integration you planned for this sprint can slip to next quarter.

Which identity verification APIs can you test alone?

Nine of the 14 identity verification APIs compared in October 2026 let you reach a sandbox or test endpoint on your own: Didit, iDenfy, Stripe Identity, Sumsub, Authenticate, Persona, Plaid Identity Verification, Socure, and Veriff. Getting in is only the first check, because a sandbox you cannot steer into a fail proves little beyond your happy path.

• Self-serve test access: credentials or a test endpoint with no sales call.
• Documented outcome control: public instructions for forcing a pass, a fail, or an edge case.
• Launch without a sales call: a documented path to live traffic through payment, an agreement, or an integration review.
• Per-check price published: a price per check you can read without asking, whatever minimums sit around it.

Nobody here called an API or uploaded a document, so every cell records only what a vendor's public pages documented on October 15, 2026, plus iBeta and NIST where the text cites them. A Partial means the pages cover the step with a gap. A No means only that they were silent that day, which makes each No the first question to put to that vendor. Authenticate published this page and is one of the 14, so give its row the same skepticism as the other 13.

The price column records only whether a price is public, because what KYC costs per customer also turns on monthly minimums and on which attempts get billed. Authenticate's list price for a government ID check is higher than the per-check rate published by any other vendor in this comparison.

No sandbox here is documented as returning the production decision on a real document, so your real rejection rate stays unknown until live traffic. Spend any free live checks, such as Stripe's first verifications or the Sumsub and iDenfy trials, on your own documents. If you run a regulated program, rank vendors by your obligations first and by access second.

How does an identity verification API work?

An identity verification API, or ID verification API, checks a document, selfie, or typed details against security features and trusted records, then returns a decision. A verification takes four steps: your server creates a session, the person completes capture, a webhook reports, and your server fetches the decision. Only capture runs on the person's device, which never decides access.

1. Create the session on your server: your secret key returns a session ID plus a short-lived token or URL for the browser or app. Stripe recommends an idempotency key, so one person never gets two sessions.
2. Hand capture to the person: a hosted page or SDK collects the images. The client-side callback means only that the person finished, and Plaid warns against reading it as a pass, so never grant access on it.
3. Wait for the webhook: the decision can land after capture ends, and the same delivery can arrive twice. Build the receiver to ignore repeats, as Veriff and Socure ask, keyed on an ID such as Socure's event_id.
4. Fetch the decision and keep your own record: Sumsub and Trulioo leave personal data out of webhook bodies, so your handler calls back for the result. Store it yourself, because Socure says it "is not a system of record for long-term data retention."

Until you verify its signature, a webhook is a POST anyone could send. Nine of the 14 document signed result webhooks as of October 2026: Didit, iDenfy, Stripe Identity, Sumsub, Persona, Plaid Identity Verification, Veriff, Onfido (Entrust), and Trulioo. Most sign with HMAC-SHA256. Plaid instead signs a JWT and calls checking it optional, which is the one optional step to make mandatory. For Authenticate, GBG, ID.me, Jumio, and Socure, which document no signature on result webhooks, ask how to reject a forged call before you build the receiver.

What should you do with a review or resubmit status?

A review or resubmit status means the vendor has not reached a final answer. Your onboarding flow needs a retry screen for the person and a review queue for your staff, because a pass-or-fail model has nowhere to send that third outcome.

Map each vendor's states first. The names differ, and so does who acts next. Sumsub splits a rejection into RETRY, when the person may resubmit, and FINAL, for a suspected fraudster or a person you don't accept. Veriff sends review only if you agreed to it beforehand. Plaid takes the most wiring: a returning user gets no new session until your retry button calls its retry endpoint or someone authorizes another attempt in the Dashboard.

Which KYC API fits your situation?

The KYC API that fits your situation is the one whose docs cover your hardest requirement, because all 14 verify a document and a selfie. As of October 2026, six launch without a sales call, and four pass all four access checks: Didit, iDenfy, Stripe Identity, and Sumsub. A Flutter app or an SSN match shrinks the list.

• An SSN match for US fintech: Persona and Socure name eCBSV, the Social Security Administration's own match of name, SSN, and date of birth, which only financial institutions and their service providers can use. Authenticate, Didit, iDenfy, Plaid Identity Verification, Sumsub, and Veriff match SSNs through other data sources.
• A Flutter or React Native app: Didit, iDenfy, Sumsub, and Veriff document both SDKs and a sandbox you open yourself, as does Plaid Identity Verification for US, Canadian, and UK companies. Jumio and Onfido (Entrust) ship Flutter after a sales conversation.
• Sellers already paid through Stripe Connect: Stripe Identity runs on the same keys and Dashboard. Connect already verifies KYC details on connected accounts before payout, and that check may already cover the sellers you meant to verify.
• Identity, company, and sanctions checks from one vendor: Authenticate, Didit, Persona, Socure, and Sumsub document KYC, KYB (know your business), and AML (anti-money laundering) screening with self-serve testing, though Sumsub's KYB needs its Custom plan. GBG and Trulioo cover all three after a sales conversation. iDenfy does too, once a demo opens KYB.
• US criminal records alongside identity: Authenticate pairs identity checks with court-record searches and daily monitoring under one user key. iDenfy's automatic search covers US-issued documents only, and Trulioo's comes after a sales conversation. Authenticate's consent terms exclude FCRA purposes such as hiring.
• An EU data region and a signed evidence file: Onfido (Entrust) makes you pick an EU, US, or Canadian host, and its ETSI package returns an evidence PDF signed with a qualified certificate. For EU residency alone, Didit processes in the EU by default, and iDenfy says "All data lives in the EU."
• Government or benefits sign-in with a wallet users already hold: ID.me returns verified attributes from that wallet, so you run no capture.
• Country-by-country data checks without a document: Trulioo, an identity matching API, checks typed details against government, bureau, and telecom sources in the countries your contract lists. Didit and Sumsub sell database checks too, though Didit silently skips a document-free check unless the workflow names exactly one country.
• Your own capture UI: Authenticate, Didit, Sumsub, and Veriff accept images from your own capture screen without a sales conversation. GBG, Jumio, Onfido (Entrust), and Trulioo accept them after one.

What does a KYC API check besides the ID?

A KYC API usually adds two checks to the document and selfie. One is a data match, which compares typed details like a Social Security number (SSN) against records, as an SSN verification API does. The other is sanctions and PEP (politically exposed person) screening for AML (anti-money laundering) programs. Each check a vendor lacks means a second vendor.

Twelve of the 14 document sanctions or watchlist screening and eight document KYB, so needing an AML screening API barely narrows the field. US criminal records are the column that cuts, taking 14 vendors down to three. If you are buying a KYC platform for compliance staff rather than an API for your code, start from the best KYC software providers of 2026.

Which identity verification APIs support mobile onboarding?

Your app's framework decides how many identity verification APIs you can use for mobile onboarding. Thirteen of the 14 compared in October 2026 document native iOS and Android SDKs, and 11 document React Native, but a Flutter app halves the field to Didit, iDenfy, Sumsub, Plaid Identity Verification, Veriff, Jumio, and Onfido (Entrust), counting vendor-built wrappers.

The bigger decision is who owns the camera. NIST SP 800-63A-4 requires live document capture and controls that "increase confidence that digital media is being produced by a genuine sensor," naming virtual cameras, device emulators, and jailbroken devices. A vendor's identity verification SDK can look for those signals on the phone. A document verification API endpoint that receives a base64 image cannot, because it never sees where the image came from. It also cannot run the document checks that need a physical card in front of a lens.

iDenfy is plain about the limit of its injection checks: an attacker who "skips the iDenfy front end entirely and posts a plain image to the API bypasses them," so they protect only iDenfy's own capture screen. If your design needs a custom camera screen, those controls become your job.

KYC APIs that pass all four developer access checks

Didit, iDenfy, Stripe Identity, and Sumsub clear every access check. Among them, the best KYC API is the one whose scope matches your product.

Didit

Best for: a test suite that reproduces each decline by name.

A sandbox_scenario slug such as decline_document_expired reproduces one decline by name, which lets you write a failing test for each decline before the integration works. The sandbox runs as a separate application with its own key and mocked, unbilled sessions. Signup takes no card, production needs no documented approval, and prepaid per-feature credits with no minimum hold a pilot's cost to what it runs.

Sanctions screening spans 1,300+ lists, but the US credit bureau lookup returns no portrait, and that path has no face to match. The iBeta Level 1 letter, dated February 4, 2026, comes from a test on one iPhone in Safari, thin evidence for an Android build.

Set a retention window yourself, because stored data has no default time limit, and send the privacy_erasure instruction with any session DELETE that must purge biometric templates. Webhooks give up early, too: "After the second retry the delivery is dropped" and the event waits in the Business Console for a manual replay.

Worth asking: how long can you replay a dropped event?

iDenfy

Best for: document-and-selfie KYC billed only when a check is approved.

The webhook receiver is the first thing you build for iDenfy: "iDenfy does not support regular polling and may restrict your access." Results arrive HMAC-signed, with a final flag on the definitive one. Acknowledge each delivery before you process it, because your endpoint has 10 seconds to answer before a retry. A dummyStatus value forces APPROVED, DENIED, SUSPECTED, or EXPIRED once the DEV environment holds a prepaid balance. Moving to a pay-as-you-go plan is then a key swap: "Your code stays the same, only the keys change."

Pricing carries a monthly minimum, with an approved-only option under which "Failed attempts, fraud, and abandoned sessions cost nothing." For US users, the AAMVA driver's license check skips eight states, among them California, New York, and Pennsylvania. The automatic criminal search also skips anyone holding a foreign passport. Build your own consent screen, since iDenfy calls its "Agree & continue" button "a transparency and acknowledgment measure, not a consent mechanism."

Worth asking: how do you run a criminal search for a user the automatic one skips?

Stripe Identity

Best for: adding verification to the Stripe account and Dashboard you already run.

Your company's location decides whether Stripe Identity is generally available to you, as in the US, the UK, and Japan, or a self-serve public beta, as in 31 other countries. Either way, the KYC program stays yours, as Stripe says itself: "Stripe is not offering a comprehensive method of complying with regulatory legal obligations like Know-Your-Customer (KYC)." Documents in Arabic, Chinese, Cyrillic, or five other scripts need another path, because Stripe doesn't extract their fields.

You rehearse a decline by picking a predefined test case in the hosted flow, but with no published table of API magic values, an automated suite has nothing documented to call. There is no monthly fee, and SSN lookups are priced separately.

Your privacy notice needs the retention rule, "Stripe retains biometric data for one year and non-biometric data for seven years." Deleting sooner means a redaction, which takes up to four days. You learn it has finished only if you subscribe to the redacted event by name, because an endpoint that takes all events won't receive it.

Worth asking: can a redaction be expedited for a shorter legal deadline?

Sumsub

Best for: one contract covering KYC, KYB, and AML screening.

Signatures run both ways with Sumsub. Each request you send carries an HMAC-SHA256 signature and a timestamp that must sit within a minute of Sumsub's server time, so clock drift on your servers surfaces as an authentication error. The webhooks coming back are signed too.

After a card signup, sandbox presets force Approve or Reject per check, and a testCompleted call simulates a final review. Production keys follow an integration check, which on the self-service plan is a checklist. Two Sumsub pages disagree on which sandbox settings carry into production.

Plans bill completed checks against a monthly minimum, and a failed card payment drops a self-service account back to Sandbox mode. Capture has one hard limit, "Only the SDK supports our Liveness feature," so images from your own camera screen get no liveness detection. Without the SDK, consent is yours to build too, because Sumsub treats missing consent as a "material breach." Ask how erasure reaches Sumsub before you promise it to your users, because the public reference lists no deletion endpoint.

Worth asking: which of those two pages is current?

ID verification APIs you can test alone, with gaps

Authenticate, Persona, Plaid Identity Verification, Socure, and Veriff let you start testing the day you sign up. Each then stalls at a different later check, and that check sets your launch date.

Authenticate

Best for: identity checks and US court records under one API key.

The REST API that runs Authenticate's identity checks also orders county, federal, and civil court records, motor vehicle records, and True Continuous Monitoring (TCM™), which checks a verified person daily for new arrests, warrants, or imprisonments. A consent call must succeed before any check runs. Authenticate's consent terms bar using results for purposes covered by the Fair Credit Reporting Act (FCRA), such as credit or employment eligibility, so a background check for hiring is a separate purchase.

Signup opens mock endpoints with five preset scenarios on the production host, with no test keys, but the mocks stop at the camera. Authenticate warns that "real-time identity verification and document capture cannot be mocked," so your first capture test is paid live traffic, which takes a signed agreement and a prepaid deposit, with no monthly minimum. Medallion™, Authenticate's hosted verification flow, opens by link, JWT, or iframe if you would rather not build capture.

The public docs leave five gaps. Two sit in capture, where Medallion won't verify a government ID on desktop and mobile support stops at an Android app and WebView guidance, with no native iOS SDK. Two sit in your backend, where webhooks show no signature scheme and the only documented DELETE removes someone from monitoring without erasing their data. The last is in the evidence: the "iBeta Level 2-compliant liveness detection" claim sits on a marketing FAQ that links no letter. Even the coverage figures disagree, with 7,500+ government ID types across 203 countries on product pages but larger figures on the homepage.

Worth asking: which coverage figure will your contract carry, and which of the five gaps are scheduled to close?

Persona

Best for: flows you configure in a dashboard and test with sample data on day one.

Persona documents two roads to production. The API reference and the help center both say to contact Persona, yet the same help center tells a Sandbox-only trial to pick a plan under Organization > Billing. Settle which road is yours inside the 60-day free sandbox. The Essential plan's 12-month minimum term turns a pilot into a year's commitment, and a per-verification price appears only in the Startup Program terms.

You can force outcomes three ways, through a dashboard toggle, a Simulate Actions endpoint, or named test inputs. Retention is murkier. The help center says ID and selfie scans are kept "indefinitely" by default, while the processor privacy policy sets a three-year limit, subject to your retention period. Your own privacy notice can state only one of those.

Worth asking: will Persona write one retention period for scans into your contract?

Plaid Identity Verification

Best for: US, Canadian, and UK companies already pulling bank data through Plaid.

Plaid starts with a condition on where you are based: "your company must be based in the US, Canada, or UK" to integrate. The sandbox is one Enable Sandbox click away, with a fixed test user for scripted runs. Much of the verification logic, though, lives in the Dashboard and Template Editor as templates, overrides, and conditional steps, outside your code review. Access to both comes through an account manager or a Product Access request with unpublished approval criteria. You can call the API on day one, then wait on that request to change what the flow does.

In code, hosted verification links cannot be iframed and the backend-only flow drops document and selfie checks. Document checks verify only the name and date of birth on an ID, so matching its address or ID number takes a Data Source check. The API reference lists no override for correcting a wrong result.

Worth asking: what gets a Product Access request approved, and how fast?

Socure

Best for: US fintech onboarding that pairs document checks with Social Security Administration (SSA) SSN matching.

Production at Socure starts at zero transactions per second. The Launch page promises no sales calls, and that holds. Traffic still waits until Support activates production and a Socure engineer signs off in a live SDK certification demo, which makes that demo the first date to book. Socure then "evaluates your request and updates your production limits to an approved throughput level" on criteria it does not publish, and until it answers, your launch-day volume is a guess. If eCBSV is why Socure made your list, expect three more steps: you register with the SSA as a Permitted Entity, provide SOC 2 evidence, and sign an addendum.

Every check runs through one endpoint, POST /api/evaluation, and a workflow you configure in the RiskOS dashboard. Test outcomes for DocV, Socure's document verification product, need a docvTransactionToken whose values the public page omits. Socure's "NIST PAD Level 2 liveness detection" also names a level NIST does not issue, because PAD (presentation attack detection) levels belong to iBeta's test, covered below.

Worth asking: can eCBSV registration run alongside the certification demo, or does one wait on the other?

Veriff

Best for: a published plan you can buy today and native SDKs that reach Flutter and Cordova.

Veriff verifies you before it verifies your users. A trial account's owner has to complete Veriff's own identity check within 15 days, or the account goes inactive. If you inherit an older integration, you have a second deadline, December 9, 2026, when Veriff shuts its legacy API hosts. Its deletion endpoint is also off by default.

The trial needs no card and creates test integrations automatically, but test sessions get no Veriff decision. You set statuses by hand in the Customer Portal from a guide behind a login. Self-serve plans with monthly minimums take you live. On Plus and Premium, an engine "combines highly automated AI-based decisions with manual fallback to verification specialists as needed," while Essential's Full Auto sessions return no reason codes, which matters the first time a declined user asks you why.

Worth asking: once switched on, does the deletion endpoint erase biometric data too?

KYC API providers that start with a conversation

At GBG, ID.me, Jumio, Onfido (Entrust), and Trulioo, a person stands between you and an identity verification sandbox, and none of these KYC API providers publishes a per-check price. Shortlist one when you need scope the self-serve nine lack, and start the conversation in week one, because every step before code waits on a reply.

GBG

Best for: building journeys visually, with digital ID wallets and KYB modules behind one API.

GBG's webhook sends only identifiers, so your handler polls GBG for the result. Nothing is testable until GBG provisions an account, since there is no public signup and the Preview environment sits inside one. Read the OpenAPI spec before the guides, because sandbox scenarios, set with an x-gbg-scenario header, appear only there.

If you still run GBG's legacy Compliance platform, used mainly in the Americas, get a migration date first. GBG's annual results say it decided in its 2026 financial year to retire that platform.

On liveness, GBG publishes "ISO/IEC 30107-3 Level 2 Passive Liveness Checks" with no lab named. Without a lab and a date, there is no letter to look up.

Worth asking: how soon after the webhook can your handler poll for the result?

ID.me

Best for: US benefits, government, and healthcare sign-ins by users who already hold an ID.me wallet.

To your app, ID.me looks like a login. It is a federated identity provider: you redirect the user over OAuth 2.0, OpenID Connect, or SAML, and they sign in to their wallet. What comes back is verified attributes in place of raw check results, so you accept ID.me's verdict without seeing the check behind it. A user who already holds a wallet skips capture, and ID.me says "Over 50 million Americans have already verified their identities to NIST IAL2 and AAL2," the identity and authenticator assurance levels NIST defines. Check the standard behind those levels, because ID.me's Kantara approval is under the superseded SP 800-63-3.

A self-serve account opens only a credential-validation sandbox. The identity verification sandbox and Services API keys come through a solution consultant or account manager, with test personas for named failures. Only Shared Signals events are documented as signed, so Services API webhooks carry no published proof of origin.

Worth asking: is an SP 800-63-4 assessment scheduled, and when?

Jumio

Best for: large programs that run raw-API capture in their own UI and need regional data centers.

At Jumio, credentials, workflow configuration, and account setup all route through an account manager, which makes a person your first dependency. Data residency is then a choice you make in the URL, with endpoints split across the Americas, EMEA, and APAC. Coverage runs to more than 5,000 ID types across 200 countries and territories. A public mock service forces decision labels through a JSON string, but only on a dedicated tenant that support or your account manager sets up. Callbacks are secured only by an IP allowlist, and any check beyond that one is yours to build.

The iBeta Level 2 result covers what an October 2025 release calls "in-house liveness detection technology." The iOS SDK FAQ lists iProov as an optional dependency, though, so the engine your workflow runs may differ from the one tested. Confirm which one yours runs before you cite the letter.

Worth asking: can callbacks carry a signature on top of the IP allowlist?

Onfido (Entrust)

Best for: EU-regulated flows that need a signed evidence file and a chosen data region.

Support for the Onfido SDKs runs until June 2027, by Entrust's estimate, so an app built on them today ships with a deadline. Since Entrust's acquisition on April 9, 2024, the old Onfido signup address redirects to an Entrust contact-sales page. Once you have an account, sandbox requests are free, and an applicant last name of "Consider" forces a consider result. API v3.6 has no default region, and you fix the host, along with the tokens bound to it, before your first call.

If the signed evidence file is why Onfido is on your list, check the ETSI certificate behind it, because the copy Onfido links reads "valid until 31 May 2025." A December 2025 practice statement calls Motion, Entrust's liveness product, "iBeta PAD Levels 1 and 2 certified on both iOS and Android." The iBeta letters below differ by product and level.

Worth asking: has the ETSI certificate been renewed, and does an iBeta letter cover the Motion version and platform you would ship?

Trulioo

Best for: matching typed details against government, bureau, and telecom records, country by country.

With Trulioo, the contract is part of the integration, because it sets your country coverage, and a country missing from it is one your onboarding cannot check. Test entities cover the data checks only, while Document Verification gets a demo license with consistent mocked responses, so a flow that runs both needs two test setups.

Trulioo's April 8, 2026 platform update added a US Criminal Check, which makes it one of three vendors here with US criminal records. Its liveness evidence is thinner, an "iBeta Level 2 certification" claimed with no date or letter.

Webhooks come from three separate systems. Confirm which one your product uses, and request its HMAC-SHA256 signing secret with your credentials. If data residency matters, Workflow Studio is the catch, because its transactions "may be processed outside an intended geographic region."

Worth asking: will Trulioo write the processing location into the same contract that sets your countries?

What does an iBeta Level 2 liveness claim prove?

An iBeta Level 2 liveness claim proves that one product version, on the devices tested, passed Level 2 of iBeta's presentation attack test to ISO/IEC 30107-3. At that level, testers use 3D prints and resin or latex masks, and at most 1% of attacks may succeed. It covers your build only if the letter names your version and devices.

The ISO/IEC 30107-3 standard behind iBeta's test excludes injection attacks, such as a deepfake fed through a virtual camera, which never passes in front of the lens. NIST SP 800-63A-4 now asks for both, which is why liveness detection has to be tested against both kinds of attack. On June 4, 2026, iBeta launched injection testing against CEN/TS 18099, yet none of the 14 publicly claimed a result from it as of October 15, 2026.

For presentation attacks, NIST sets its own bar: a remote check must let through fewer than 7 in 100 attacks of any one type, an impostor attack presentation accept rate (IAPAR) below 0.07. iBeta's 1% looks like the stricter bar, but the two numbers measure different things. Many iBeta letters score the liveness component alone, while NIST's figure covers the whole check, so even a clean Level 2 letter cannot tell you whether a vendor meets NIST. Get the vendor's whole-check figure against NIST's bar in writing.

Six of the 14 have letters on iBeta's public list, but the product a letter names matters more than its level, because a letter vouches only for what was tested. Onfido is the case in point: its 2022 Level 2 letters cover an earlier product, while Entrust's Onfido Motion holds a Level 1 letter, as does Didit. Jumio, Persona, Sumsub, and Veriff hold Level 2 letters, the newest Jumio's from September 11, 2025. Sumsub has since added a Level 3 letter dated September 17, 2026. Sumsub files its recent letters under its Cyprus holding company, Raritex Trade, which means a search by the Sumsub name alone misses its newest evidence.

Authenticate, GBG, iDenfy, Socure, and Trulioo claim a tested level with no letter located. Letters reach the list only with the vendor's consent, so a missing one proves nothing, and the letter itself is what to request from those five.

The Department of Homeland Security's Remote Identity Validation Rally tested systems in 2025. Active liveness held up better there: only one of the 12 passive liveness systems kept worst-case attack acceptance under 5%, against three of six active systems. The results are anonymized, so your own traffic remains the better test of any vendor here.

Frequently asked questions

Is there a free KYC API?

A free KYC API exists only in pieces: sandboxes and trials cost nothing at most of the 14 vendors compared in October 2026, while live verifications are billed after any free starter checks. Didit, Persona, and Plaid document free sandboxes, Persona's for 60 days, and Socure Launch adds monthly credits. Didit replaces its per-feature monthly free checks with a monthly credit on November 1, 2026, so read the terms on the day you sign.

What is the difference between a KYC API and an identity verification API?

A KYC verification API wraps identity verification in the record-keeping a regulated institution owes. Under 31 CFR 1020.220, a US bank's customer identification program must collect at least a name, date of birth, address, and identification number, then verify them. KYC platforms such as Sumsub and Didit add sanctions and PEP (politically exposed person) screening on the same API, while an identity verification API can stop at the document and face.

What is an identity matching API?

An identity matching API, sometimes called an identity validation API, compares details a person types, such as name, date of birth, or Social Security number, against bureau, carrier, or government records. A match shows the identity exists, though not that the person typing owns it. NIST SP 800-63A-4 says knowledge of an SSN is not evidence of identity, and the SSA's eCBSV (electronic Consent Based SSN Verification) match is open only to financial institutions and their service providers.

How do identity verification APIs charge?

Identity verification APIs charge per check under one of four models: per completed verification, per attempt including failures and retries, per check on top of a monthly minimum, or a committed annual contract. The billing model is the bigger lever on your real cost, so compare models before list prices. As of October 2026, Plaid charges a base fee for every verification attempted, while Veriff says "you only pay for actual verification sessions, not for retry attempts."

What to ask an identity verification API vendor

Five questions cover what the vendors' own pages left open across all 14, and a written answer is one you can hold a vendor to.

1. How do I verify that a webhook came from you, and how long do you retry a failed delivery?
2. Which attempts do you bill: completed checks, failures, abandoned sessions, or retries?
3. What is your false-reject rate on traffic like mine, by country and document type, and can I measure it in a paid pilot?
4. Which injection attacks have you tested, and will you send the tested attack types and false negative rates that NIST SP 800-63A-4 says "SHALL be documented and made available to RPs upon request"?
5. Which endpoint deletes a person's data, including biometric templates? Eight of the 14 document one in their public API reference.

If US court records or ongoing monitoring are on your list, Authenticate's signup and mock endpoints cost nothing, so you can wire up result handling this week. Put the webhook question to Authenticate too, before you pay the prepaid deposit that live traffic requires.

Related resources

• Best identity verification software in 2026, compared
• KYC software and the two requirements it misses