Authentication

Fidera supports tenant secret keys, restricted publishable keys, and operator sessions. Choose the least-powerful credential that fits the caller.

Credential	Prefix or transport	Intended caller	Scope
Tenant secret key	tnk_ Bearer token	Trusted backend	Full tenant API access
Publishable key	pk_ Bearer token	Browser or mobile client	Restricted synchronous Flow creation
Operator session	Secure HTTP-only cookie	Fidera dashboard	Tenant role and permission gates

Secret keys

Send the tenant key in the Authorization header:

Authorization: Bearer tnk_...

curl https://api.fideralabs.com/v1/checks \
  --header "Authorization: Bearer $FIDERA_API_KEY"

Never place a tnk_ key in browser JavaScript, mobile application bundles, logs, support tickets, analytics, or committed configuration. Rotate a key immediately if it may have been exposed.

Publishable keys

A pk_ key is browser-safe only because its authority is deliberately narrow. It can create an eligible checks-only Flow in synchronous mode. It cannot read Applicants, Checks, Matches, Monitors, policy, or webhook configuration.

Publishable requests are origin-checked and rate-limited. Those controls reduce abuse; they do not turn a publishable key into a secret.

Operator sessions and roles

The Fidera dashboard authenticates operators with a secure session cookie. Public /v1 endpoints that support operator actions apply the same tenant and role checks to the session as they do to API callers.

• Analysts can inspect screening evidence in the dashboard.
• Supervisors can perform approval actions that require separation of duties.
• Admins can manage tenant-wide configuration and operators' privileged operations.

Bearer tenant keys are machine credentials and are treated as tenant-admin authority. Use them only from trusted services.

Unauthorized responses

401 means the credential is absent, malformed, expired, or unknown. 403 means Fidera recognized the caller but the role, tenant policy, or endpoint does not permit the requested action.

A 403 reading Tenant is pending_verification means the account exists but hasn't finished its identity check. The key is real; it just isn't active yet. See Create an account.

Allowance

Self-serve accounts include a fixed number of checks. When it is spent, calls that would run a check return 402:

{
  "error": {
    "code": "allowance_exhausted",
    "message": "You have used all 250 checks included with this account. Contact sales@fideralabs.com to raise the limit.",
    "details": { "allowance": 250, "consumed": 250 }
  }
}

402 is not a rate limit and retrying will not clear it. Accounts with a contract are unmetered and never see this response.