Sinch fax alternative

mintfax is a developer-first fax service for teams evaluating Sinch’s Fax API, the Phaxio-derived v3 product on Sinch’s developer portal. Sinch runs a broad CPaaS across fax, SMS, voice, and RCS. mintfax is outbound-only and narrower. On the send path, mintfax signs every webhook, honours idempotency keys on POST /faxes, returns a stable public error taxonomy, and includes a nine-scenario sandbox with parity to live.

What Sinch does well

Sinch’s Fax API is a long-running developer brand at developers.sinch.com/docs/fax. Sinch’s marketing page prices it verbatim as a “flat rate of $0.045 per page, with transparent pricing and no hidden charges.” The BAA is free to sign in the Build dashboard via DocuSign. The API endpoint enforces TLS 1.2 in transit. The accepted upload list covers the common developer formats: .docx, .html, .jpg, .png, .tif, .pdf, and .txt. Sinch also documents a single fax test number that emulates an outbound send without a charge, and Sinch supports receive as well as send.

Feature comparison

Where mintfax leads

Signed webhooks

Sinch’s v2-to-v3 migration guide states verbatim: “Webhook signatures: Removed due to low usage, at the moment V3 does not support webhook signatures.” In v3, the webhook uses HTTP Basic authentication instead. mintfax signs every webhook delivery with HMAC-SHA256 following the Standard Webhooks specification. Every endpoint has its own signing secret in the format whsec_ + base64-encoded 32 random bytes. Every attempt carries three headers: webhook-id, webhook-timestamp, and webhook-signature. Standard Webhooks client libraries verify the payload in a few lines.

Idempotency on send

Sinch’s Fax API documentation returns no reference to Idempotency-Key, idempotent, or an equivalent replay-safety token across the introduction, the migration guide, the getting-started guide, and the API reference. mintfax honours Idempotency-Key on POST /faxes. Keys expire after 24 hours. A reused key with a different body returns 409 idempotency_key_reuse. A reused key while the original is still running returns 409 idempotency_key_in_progress. Replays carry Idempotent-Replayed: true. If you omit the header, the response carries an X-Idempotency-Key: not provided; recommended header.

Structured errors on the send call

Sinch v3 mixes HTTP status codes with a type discriminator (DOCUMENT_CONVERSION_ERROR, CALL_ERROR, FAX_ERROR, FATAL_ERROR, GENERAL_ERROR) and an integer errorCode such as 4, 17, 54, or 128. contentUrl fetch failures return an HTTP 800, outside the standard HTTP status range. mintfax splits the taxonomy: a 17-code stable public API taxonomy for request-time errors, and a separate 10-code carrier taxonomy on the fax record (busy, no_answer, line_quality, carrier_busy, network_error, timeout, internal_error, invalid_number, bad_destination, no_route) with an optional error_subcode. Every mintfax response, error or not, carries X-Request-Id: req_<ULID>, and error envelopes echo the same value as request_id.

Self-serve compliance path

Sinch’s legal HIPAA policy states verbatim: “Primary responsibility for compliance with HIPAA rests with you.” The BAA is described as “an addendum to our standard Terms of Service.” On the developer-portal HIPAA page, PHI storage is on by default; a HIPAA-safe setup requires unchecking storage boxes in Fax > Services > HIPAA. mintfax offers BAA and DPA as separate self-serve click-through documents in the dashboard. Each acceptance writes a durable evidence record (template version, signer, IP, user agent, accepted_at); the executed PDF is downloadable immediately. A per-environment zero-footprint mode scrubs PHI after the fax is delivered or fails. Content retention defaults to 30 days and is configurable per environment in the range 7-365 days. The audit stream carries a SHA-256 hash chain for tamper detection and is exportable via GET /v1/account/audit or CSV. Details on /compliance.

Sandbox realism

Sinch documents a single fax test number that emulates a successful outbound send without a charge. The developer portal does not use the word sandbox, does not describe a separate testing environment, and points readers to production credentials for the first call. mintfax provides nine sandbox magic numbers covering nine scenarios: Delivered, Busy, NoAnswer, DelayedDelivery, LineQualityFailure, InsufficientBalance, DeliveredMultiPage, InvalidNumber, and ValidationFailure. Sandbox and live share the same API contract. The three permitted differences are (1) sandbox top-ups are simulated, (2) sandbox faxes never reach the PSTN, and (3) live requires a first credit purchase to activate. You create a sandbox via POST /account/register and verify with a 6-digit code; no card required.

When mintfax is not the right call

• Inbound fax. Sinch supports receive (fax-to-email flow, INCOMING_FAX webhook). mintfax v1 is outbound only.
• One CPaaS account across channels. Sinch runs SMS, voice, verification, and RCS alongside the Fax API. mintfax is fax-only.
• A named certification badge as a procurement gate. mintfax does not hold SOC 2 Type II, HITRUST, PCI DSS Level 1, ISO 27001, or FedRAMP.

Signed webhooks, idempotency, structured errors, self-serve BAA, and the sandbox matrix are available at every mintfax /pricing tier. Migrating from Sinch? See the migration guide. Compare mintfax against the other fax APIs at /compare.

Try it

• Try mintfax in the sandbox. No card, no BAA needed to start.