English 
Français Card Issuing · Developer APIs
Card Issuing API
Ship Programs in Days
One API call to issue virtual and physical cards, manage cardholders, and process transactions. Production-ready SDKs, real-time webhooks, and a sandbox that mirrors live — so you can go from first line of code to first card issued, fast.
~ms
Avg. Response Time
%
Uptime SLA
K+
Requests / sec
Free sandbox · No credit card required
Your sandbox mirrors production exactly.
Same endpoints, signed webhooks, simulated declines. Add one header to test — remove it to go live.
Card Issuing API Infrastructure Built for Production
No surprises when you go live. The same infrastructure that handles millions of transactions is available to you from the first API call.
Rate Limits That Scale With You
Start at 500 req/s on free tier — burst headroom included. Every response carries X-RateLimit-Remaining and X-RateLimit-Reset so your client can back off cleanly. Enterprise limits are raised via a single support ticket, no re-provisioning.
Your Server Never Touches a PAN
Card numbers are tokenized at issuance — your API responses contain a network_token, not a raw PAN. Webhook payloads are signed with HMAC-SHA256; verify the X-Fyatu-Signature header before processing. PCI DSS Level 1 certified.
Incidents Surface Before You Page On-Call
Multi-region active-active deployment with automatic failover under 30 s. Subscribe to status.fyatu.com for push alerts on any degradation. 99.9% uptime SLA with financial credits if breached.
Test Mode Is One Header Away
Sandbox uses the exact same endpoints as production — no separate base URL. Pass X-Fyatu-Mode: test to run simulated authorizations, trigger declined-card scenarios, and fire test webhooks to your local ngrok tunnel. Flip to live by removing the header.
Everything Documented, Nothing Hidden
From your first GET request to production-grade webhook handling — three resources that cover the full integration path.
Get Started
Cards
Collections
Documentation
Step-by-step guides covering authentication, card issuance, KYC flows, and common integration patterns
Cards
Collections
Payouts
Request Body
"cardholderId": "ch_...",
"name": "J. WILSON",
"amount": 100,
"type": "MASTERCARD"
}
Response
201"id": "card_01j...",
"status": "active",
"last4": "4242"
}
API Reference
Full REST reference: every endpoint, request schema, response shape, and error code in one place
Webhooks
Event catalogue with payload schemas, signature verification, retry logic, and delivery guarantees
Integration walkthrough
From zero to first card
in four API calls
Request
Response · 201 Created
Request · sandbox mode
Webhook fired · card.authorization.declined
Request
Response · 200 OK
Inbound · to your endpoint
Every Feature Exposed as an API
No dashboards required. Every card behaviour — spending rules, wallet tokens, FX conversion, auth challenges — is set and queried over REST.
JIT Authorization Webhooks
Intercept every authorization before it approves or declines. Your endpoint receives the full transaction context and returns an allow/deny decision in under 2 s — giving you programmable spend controls without a card reissue.
Per-Card Spend Controls
PATCH /v1/cards/:id/controls to whitelist MCC groups, cap daily spend, block specific merchant countries, or enforce velocity windows. Changes take effect on the next authorization — no card reissue needed.
Apple Pay & Google Pay Provisioning
POST /v1/cards/:id/wallet-tokens returns an encrypted payment token ready for PassKit or Google Pay push provisioning. No browser SDK, no redirect — your backend calls one endpoint and the wallet is live.
Stablecoin & Multi-Currency Funding
Fund card balances from EVM-compatible wallets (USDT/USDC on-chain) or fiat accounts. Automatic FX at settlement with rates locked at authorization time — visible in every transaction object.
3DS2 with Frictionless Flow
Every card is enrolled in 3DS2 by default. Low-risk transactions skip the challenge and complete frictionless; high-risk ones return an acs_url for your frontend. Friction level is tunable per card via the API.
The API design is clean — consistent naming, predictable error shapes, and the sandbox mirrors production exactly. We went from zero to issuing live cards in under two weeks.
Lead Engineer
Card Issuing Integration · African Fintech
