Onboarding & registration

Onboarding is a short exchange between you and the Fieldproof integration team. You apply online, ops reviews and configures your organisation, you get a sandbox key, you integrate against the sandbox, and at go-live your production configuration is entered again and a live key is issued.

The onboarding sequence

1. Apply

Apply at fieldproof.fluxusforge.in/apply/. The form asks for:

Section	What we ask
Organisation details	Who you are as a legal entity
Contacts	Business and technical contact details
Ingest preference	push / pull / csv — see integration paths
Payment preference	Static QR / bank (Mode A) or your own gateway's links (Mode B)
States	Where your borrowers are, so we can match field coverage

You verify your email with an OTP during the application, and on submission you receive a tracking link (https://fieldproof.fluxusforge.in/apply/status/?token=…) where you can follow the status.

2. Ops review and organisation code

The Fieldproof team reviews the application and marks it approve, needs_info (we come back to you with questions) or reject. On approval ops assigns your organisation code — the short identifier that tags every case, payment and event of yours and appears as lenderCode in GET /health and in every event envelope. You do not choose it yourself.

3. Sandbox integration configuration

Ops enters your technical configuration in the CRM (Integrations tab). Have these ready for your integration contact:

Item	What to supply
Webhook URL	One HTTPS URL on a public IP (no private/loopback addresses). Redirects are not followed, at most 64 KB of your response is read, and you must answer 2xx within 10 s. Put no query string in the URL — the webhook signature covers the URL path only.
Event subscriptions	Default: case.received, payment.collected, case.closed. case.assigned and visit.completed are opt-in — tell your contact if you want them. There is no self-serve subscription API.
Payment mode + artefacts	Mode A (static QR): static UPI QR image, UPI ID and/or bank details the borrower pays into. Mode B (org_gateway): your mint URL (HTTPS, public, answers within 10 s) and the exact Authorization header value we must send — a verbatim static string including your own scheme prefix, e.g. Bearer <your token> (mint contract).
(Pull mode) pull configuration	Your pull endpoint URL (HTTPS, public IP; GET <pullUrl>?cursor=&limit=500 returning { rows, nextCursor, hasMore }) — see the pull API contract. Fetched every 30 minutes on a global schedule.
(Optional) IP allowlist	Plain IPv4 addresses or CIDR ranges your API keys may be used from. The client IP is resolved from CF-Connecting-IP / the last X-Forwarded-For hop; requests from elsewhere get 401 UNAUTHORIZED.
RBI regulatory disclosure text	The disclosure wording shown to the borrower on the agent's payment/ID screens. Have your legal team approve it. The platform does not issue PDF receipts on your behalf — borrower receipts remain your responsibility.
Technical contact	Email + phone. Coordinates key rotation and configuration changes with us.

:::warning No alerts are sent to your technical contact The platform does not notify your organisation about signature lockouts, exhausted webhook deliveries or a suspended callback — internal Fieldproof ops are alerted, not you. Monitor your own integration with GET /webhooks/deliveries and GET /health. :::

4. Sandbox key

Once the configuration is in, a sandbox key is issued:

Item	Notes
apiKeyId	pk_<org>_test_<hex> — the Bearer token; identifies your organisation, safe to log.
Secret	An opaque string shown once at issuance. Signs your requests and verifies the webhooks we send you. Works only with the sandbox host https://alpha-gig.fluxusforge.in.

:::warning The secret is shown once It cannot be re-displayed — store it in your secrets manager on receipt. If it is lost, request a rotation from your integration contact. Rotation makes the new secret active immediately: webhooks are signed with the new secret from that moment, while your API requests are accepted with the old or new secret until the old one is retired. Make sure your webhook receiver can verify against more than one secret before asking for a rotation (key security). :::

Now build and test against the sandbox: quickstart, sandbox testing.

5. Go-live: production configuration is entered again

Nothing carries over from sandbox to production. At go-live your integration contact enters the production configuration afresh — production webhook URL, mint URL + Authorization header value (Mode B), QR / bank details (Mode A), IP allowlist, pull URL — and then a live key (pk_<org>_live_<hex>) is issued, again with a one-time secret. Switch your base URL to https://gig.fluxusforge.in; live keys are rejected on the sandbox host and test keys on production. The full list is in the go-live checklist.

Changing things later

Webhook URL, event subscriptions, payment artefacts, mint URL/header, pull URL and IP allowlist are all changed through your integration contact ([email protected]) — there is no self-serve configuration API. Key rotation and revocation go through the same channel.

What you receive — summary

Item	Notes
Organisation code	Assigned by ops; your lenderCode.
Sandbox key	pk_<org>_test_… + one-time secret; sandbox host only.
Production key	pk_<org>_live_… + one-time secret; issued at go-live after production config is entered; production host only.
Base URLs	Sandbox https://alpha-gig.fluxusforge.in · Production https://gig.fluxusforge.in (environments).
Documentation + OpenAPI spec	The spec is also served by the API at GET /api/v1/partner/openapi.json (signed request).
Reference implementation	A runnable Node mock organisation, provided by the integration team on request.