Cardly
MARKETING · MARKETING
Real greeting cards and direct mail sent from the account they connected.
Connect Cardly with Fabriq Developer
Your user pastes their Cardly credential on a page Agentic Fabriq hosts, so it never reaches your backend and never becomes one shared key across all of your users. Same call as OAuth, one more argument.
Provider names are surfaces, not vendors, and the authoritative list is the capabilities endpoint rather than any page including this one — an unknown name returns 400 with the valid list. Fabriq Developer is free to start and needs no provider paperwork. Start free or read the quickstart.
Connecting Cardly in practice
Cardly prints and posts physical cards, and the only safety net is the key prefix: a test_ key "will not perform any mutations" while a live_ key has "none of the restrictions of test mode keys", so one wrong environment variable is real mail in the post rather than a failed request.
Scopes that draw scrutiny
live_ API keyCardly separates environments by key prefix rather than by scope. A live_ key places real orders that are printed and mailed; there is no narrower production credential.test_ API keyThe sandbox equivalent: it "will not perform any mutations" and every response carries testMode: true, which is the flag an agent should assert on before trusting a dry run.
Rate limits
- 429 Too Many Requests is documented and exponential backoff is recommended, but no threshold, window or RateLimit header is published.
Worth knowing
- The credential goes in an API-Key header, not Authorization, so clients that only know bearer tokens send an unauthenticated request and get rejected.
- Test mode is the only sandbox — there is no separate host — so the environment an agent is in is determined entirely by the key string it was given.
- HTTPS is mandatory: "calls made over plain HTTP will be rejected, as will requests without authentication".
- Every response is a JSON envelope with an overall success element, messages, a data element and optionally a test-mode flag, so success has to be read from the body rather than the status code.
Checked against Cardly API documentation (2026-09-29), Cardly direct API integration (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Cardly behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.