Testing quotes diverge mostly because bidders assume different surfaces. The same application can be tested through its interface, through its API, on a range of real devices, or all three, and those are very different amounts of work. Scoping by surface makes quotes comparable and usually reveals that the cheapest bid covered the least.
API testing services are where the value density is highest
Testing at the API level is faster, more stable and more precise than driving an interface, because there is no rendering to wait for and no element to move. It catches contract breaks, validation gaps, authorisation mistakes and error handling that interface tests reach only indirectly. Authorisation is the case worth insisting on: an API that trusts the interface to hide a button is a common and serious defect, and only API level testing finds it reliably.
Web testing has to go beyond whether features work
A web application can pass every functional test and still fail its users. Require performance measured on a real mid range mobile device against the page experience signals Google publishes, and require accessibility checks against a named level of the W3C's Web Content Accessibility Guidelines, including keyboard operation and screen reader labelling on the flows that matter. Both are testable and both are routinely excluded from a quote unless you name them.
Mobile testing needs a device matrix in the contract
Mobile defects concentrate on the devices testers do not own: older handsets, lower memory, smaller screens, manufacturer specific background behaviour. Specify the device and operating system matrix in the statement of work and require either a physical lab or a named cloud device service. Also require testing of interruption behaviour, calls, notifications, the app being backgrounded and terminated, which is where a large share of real user problems live.
Functional testing services are a floor, so say what surrounds them
Functional testing verifies that the system does what the specification says. That leaves performance, security, accessibility, resilience under failure and usability outside scope unless named. When you buy functional testing, be explicit about which of those you are also buying, and accept that a bid covering only functional behaviour is not comparable to one covering more. Most apparently cheap testing quotes are cheap for exactly this reason.
Questions people ask about application testing services
Should we test at the API level or through the interface?
Both, weighted towards the API. API tests are faster, more stable and catch authorisation and contract defects that interface tests reach only indirectly. An API that relies on the interface hiding a button is a common and serious defect only API testing finds reliably.
What is usually missing from a web application testing company's quote?
Performance measured on a real mid range mobile device, and accessibility against a named WCAG level including keyboard and screen reader checks. Both are testable, both matter, and both are excluded unless you name them.
What must mobile app testing services cover?
A named device and operating system matrix including older and lower specification handsets, plus interruption behaviour: calls, notifications, backgrounding and termination. Those are where real user problems concentrate and where a testing team's own devices mislead.