I built a company-verification API for the Gulf Market

nassim haddad — Tue, 15 Sep 2026 10:24:09 +0000

Every global company-data API stops at Europe.

Stripe's data products, OpenCorporates, the big aggregators — none of them cover Saudi Arabia, UAE, Kuwait, Qatar, Bahrain, Oman, or Lebanon. The data exists, but it's scattered across seven government portals, most of them Arabic-only, some permission-only. For a developer, "verify this Gulf company" means manually hunting through portals and PDFs.

So I built the thing that should have existed.

What I built

One endpoint:

POST /api/v1/verify-company
{ "country": "SA", "trn": "310000000000000", "name": "Acme Trading LLC" }

returns:

{
"country": "SA",
"trn_format_valid": true,
"verdict": "likely",
"risk_tags": [],
"checks": {
"registry_live": "not_queried_no_feed",
"sanctions_match": "not_queried_no_feed"
}
}

It validates TRN/VAT format against each country's rules (Saudi 15 digits starting 3, UAE 15 starting 1, Kuwait/Bahrain 9, Qatar 10, Oman 8, Lebanon 5-8), surfaces risk heuristics from the name (offshore, generic-shell, newly-registered), and does it all through one deterministic contract.

The design decisions I'm actually proud of

1. Copy-once API keys

The raw key is shown to the user exactly once. From then on we store only:

SHA-256(key + pepper) and a display prefix like "lb_test_..."

Not the key itself. So a leaked key reveals nothing about the customer, and a lost key can never be recovered — you revoke it and mint a new one. This is the pattern Stripe and OpenAI use, and it's the whole game: the real key exists in exactly one place, the customer's clipboard.

2. Honest status codes

400 malformed request
401 missing / invalid / revoked key
403 email not confirmed yet
409 email already has a verified key
429 quota, rate limit, or too many signups from this IP

Each one means a real thing. No vague 500s. If you're a developer integrating this, the error tells you exactly what to fix.

3. A gatekeeper that actually gates

Every call goes through a middleware that checks the key hash, enforces a per-key quota (500 calls on the founder tier), a per-key rate limit (60 req/min, derived from the usage log so it holds across serverless instances), and traces every request with an x-request-id.

4. Anti-abuse signup

Email double opt-in (keys return 403 until confirmed), disposable-domain blocking, and per-IP caps. A squatted email can always be reclaimed by its real owner.

The decision I want feedback on most: honest scope

This is the part I'd genuinely like the community to weigh in on.

Today the API validates TRN/VAT format and returns risk heuristics. It does not query live government registries or sanctions lists. Every response carries this flag:

{ "registry_live": "not_queried_no_feed" }

I chose to ship a tool that tells you exactly what it cannot verify rather than one that silently fakes "registered" — because if someone builds a compliance decision on a fabricated verdict, that's on the tool.

The hard part is next: live registry verification. The Gulf data providers (CRIF / D&B Gulf, Kyckr) quote enterprise pricing (around 0.24 USD per lookup). At a consumer API price that wipes the margin out. So I'm stuck on the classic data-moat pricing problem — and I'd love to hear how other dev-tool builders have solved licensing expensive registry data.

Try it at:https://mena-biz-api-nassims-projects-08916750.vercel.app/**_

About 60 seconds: enter your email, click the sign-in link, create a key, then run curl:

KEY="lb_test_"
HDR="x-api-key"
curl -X POST https://mena-biz-api-nassims-projects-08916750.vercel.app/api/v1/verify-company \
-H "$HDR: $KEY" \
-H "Content-Type: application/json" \
-d '{"country":"SA","trn":"310000000000000","name":"Acme Trading LLC"}'

Founder offer: 500 free calls for the first 50 signups, no credit card.

Site: https://mena-biz-api-nassims-projects-08916750.vercel.app/
If you work with Gulf companies, KYC, or vendor onboarding — what data would you actually pay for? I'd genuinely like to know.

This is build-in-public. I'll follow up with the live-registry pricing saga and whatever the community tells me.

pico 8 game missing flag game by nassim hadadd

nassim haddad — Sat, 18 May 2024 06:05:39 +0000

hello and welcome to my 2nd post but this time related to my pico 8 game,this game was created on october 2023 and took about 1 week of development,compatible with all devices.the link of the game with full description will be provided in this post (https://www.lexaloffle.com/bbs/?tid=54568) this is the game link,
if you like my game please consider donating by copying this link to your browser(coindrop.to/nassim-98)
thanks with all respect happy coding to you all stay tuned for more awesome projects.

DEV Community: nassim haddad