Fidacy
See it in action

Getting Started

Test Mode / Sandbox

Test mode lets you integrate Fidacy safely before going live. Assessments run through the full pipeline, same validation, same signed verdict, but are flagged livemode: false so they are clearly distinguished from production traffic.

What test mode is

Test and live modes share the assessment API, validation, policy evaluation, risk scoring and EdDSA signing. When you authenticate with a fky_test_ key, every resulting assessment carries outcome.livemode: false. Test traffic uses the same API surface and organization, but it bypasses the usage gate and is not metered to Stripe. Use it to build your integration, rehearse edge cases, and validate the signed payload format without creating billable usage.

Create a test key

Pass "mode": "test" to POST /v1/api-keys. The raw key is returned once in the key field and cannot be recovered, store it securely.

POST/v1/api-keys
curl https://api.fidacy.com/v1/api-keys \
  -H "Authorization: Bearer $YOUR_KEYS_WRITE_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "my sandbox key",
    "scopes": ["assess:write"],
    "mode": "test"
  }'

Response (201):

{
  "id": "key_…",
  "name": "my sandbox key",
  "prefix": "fky_test_xA",
  "scopes": ["assess:write"],
  "key": "fky_test_xA8Qd…"   // shown once, save it now
}

Keys created without a mode field default to "live" and carry the prefix fky_live_.

Use the test key

Send the fky_test_ key as you would any API key, in x-api-key or as a Bearer token. The engine detects the prefix at auth time and sets livemode: false on every assessment that follows.

curl https://api.fidacy.com/v1/assess \
  -H "x-api-key: fky_test_xA8Qd…" \
  -H "Content-Type: application/json" \
  -d '{
    "kind": "ap2_payment",
    "mandate": { … }
  }'

The response has the same assessment contract as a live request. Check outcome.livemode to confirm you are in sandbox mode:

{
  "decision": "approve",
  "score": 12,
  "assessmentId": "asmt_…",
  "riskPayloadJws": "eyJhbGciOiJFZERTQSJ9…",
  "outcome": {
    "object": "assessment",
    "livemode": false,
    "outcome": { "decision": "approve", "risk_level": "normal", "reason": "approved" },
    …
  }
}
One org, two modes. Test and live keys belong to the same organization, there is no separate test account. Switch between environments simply by choosing which key you pass. The livemode flag on the assessment is the authoritative signal; it is set by the engine based on the authenticating key prefix, not by anything in the request body.

Revoking a test key

Test keys follow the same lifecycle as live keys. Revoke one when you no longer need it:

curl -X POST https://api.fidacy.com/v1/api-keys/:id/revoke \
  -H "Authorization: Bearer $YOUR_KEYS_WRITE_KEY"
  • ·The signed verdict (riskPayloadJws) is issued exactly as in production, verifiable against the public JWKS at /.well-known/jwks.json.
  • ·Test mode does not exercise live usage-gate behavior. Test failures still need the same handling policy as live failures: no successful verdict means no approval.
  • ·There are no test-only endpoints. Every call goes to the same API surface; only the key prefix changes the behavior.
Next →How Fidacy Works