Fidel API
BUSINESS · COMMERCE & FINANCE
Card-linking programs, cards, transactions, and offers on their own key.
Connecting Fidel API in practice
Fidel authenticates with a `fidel-key` header rather than an Authorization one, and the environment is a property of the key, not the request: an `sk_test_` key and an `sk_live_` key call the same endpoints against different data. Some endpoints exist in only one mode — creating a transaction is test-only, sending an offer to a brand is live-only — so the live path cannot be rehearsed.
Scopes that draw scrutiny
fidel-key: sk_live_… (secret key)Server-side only. Fidel’s documentation says "Do not share or include your secret API keys on client-side code", because the key reaches enrolled cards, transactions and live offers.Public keyThe client-side SDK credential used for card enrolment, which is the point at which a cardholder’s primary account number enters the flow.
Worth knowing
- Switching between test and live means swapping the key, so a mis-set environment variable moves real card data instead of failing loudly.
- Create Transaction exists only in test mode, so end-to-end behaviour of a live programme cannot be simulated with synthetic transactions.
- Send Offer to Brand is live-only, which means the offer-distribution step of an integration has no test-mode equivalent to develop against.
- Webhooks are registered separately per brand and per programme, so a new programme silently receives no events until its own webhook is created.
Checked against Fidel API authentication (2026-09-29), Fidel API reference index (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Fidel API behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.