Authentication

Fidera supports tenant secret keys, restricted publishable keys, and operator sessions. Choose the least-powerful credential that fits the caller.

Credential	Prefix or transport	Intended caller	Scope
Tenant secret key	tnk_ Bearer token	Trusted backend	Full tenant API access
Publishable key	pk_ Bearer token	Browser or mobile client	Restricted synchronous Flow creation
Operator session	Secure HTTP-only cookie	Fidera dashboard	Tenant role and permission gates

Secret keys

Send the tenant key in the Authorization header:

Authorization: Bearer tnk_...

curl https://api.fideralabs.com/v1/checks \
  --header "Authorization: Bearer $FIDERA_API_KEY"

Never place a tnk_ key in browser JavaScript, mobile application bundles, logs, support tickets, analytics, or committed configuration. Rotate a key immediately if it may have been exposed.

Publishable keys

A pk_ key is browser-safe only because its authority is deliberately narrow. It can create an eligible checks-only Flow in synchronous mode. It cannot read Applicants, Checks, Alerts, policy, operators, or webhook configuration.

Publishable requests are origin-checked and rate-limited. Those controls reduce abuse; they do not turn a publishable key into a secret.

Operator sessions and roles

The Fidera dashboard authenticates operators with a secure session cookie. Public /v1 endpoints that support operator actions apply the same tenant and role checks to the session as they do to API callers.

• Analysts can work Alerts within the configured workflow.
• Supervisors can perform approval actions that require separation of duties.
• Admins can manage tenant-wide configuration and operators' privileged operations.

Bearer tenant keys are machine credentials and are treated as tenant-admin authority. Use them only from trusted services.

Unauthorized responses

401 means the credential is absent, malformed, expired, or unknown. 403 means Fidera recognized the caller but the role, tenant policy, or endpoint does not permit the requested action.