Whop’s tutorial on how to integrate a KYC verification API into your platform makes one argument and then builds it in Next.js: if you are verifying people because you are going to pay them, the KYC check should live inside the payouts API. One call starts a verification against an account, Whop returns a record whose ID starts with idpf_ plus a link to a Whop-hosted page, the person finishes there, and approval switches on payouts for the same account. The line worth keeping is the takeaway: “Treat webhooks as change signals only, re-reading the record before writing any verification status.”
There are no vendor figures here to discount, only engineering advice, and most of it is good on its merits. The tutorial asks for narrow key scopes (identity:write, identity:read, webhook_receive:identity_profiles), passes an idempotency key on create, validates every environment variable on startup, and handles the action_required state a reviewer can come back with before money moves. It also flags a quiet trap: older SDK option names like apiKey and baseURL are “silently ignored” in plain JavaScript, “which sends every call to production instead of the sandbox environment.” That is exactly the kind of sentence a provider rarely writes about its own SDK.
The catalog answer is the interesting part. Whop on apis.io carries 12 API pages, and the payout half of the story is there: the Whop Payments API, the Whop Transfers API, the Whop Companies API that owns the biz_ accounts being verified, the Whop Users API, and the Whop Webhooks API that delivers the result events. The verifications surface itself, the verifications.create and verifications.retrieve calls the whole tutorial is about, has no API page. The agentic access profile counts 51 operations, 30 of them acting, and none of them is the identity check.
The measurement explains why. Whop scores 21.2 on the Kin Score, emerging, carried by discoverability at 66.1 and developer ergonomics at 32.1, with access clarity at 7.9 and operational transparency at 13.2. Agent Readiness is 38.6, agent-ready, with MCP server, delegated identity, protected resource metadata and dynamic client registration lit. Idempotency and error semantics are unlit, yet the tutorial passes an idempotency key and documents a 404 on an unknown record. Whop is writing a better contract in its blog than the one we can measure, which means the fix is a published spec for identity, not better prose.