# Cardless

> Cardless, Inc. is a San Francisco fintech operating an embedded co-branded credit card platform. Consumer brands use Cardless APIs and pre-built components to launch and run their own credit card programs natively inside their apps and websites, while Cardless handles issuing-bank relationships, card production, underwriting, fraud, KYC/AML compliance, servicing and support. The platform is network-agnostic across Visa, Mastercard and American Express. Partners include Coinbase (Coinbase One Card), Bilt, Qatar Airways Privilege Club, Alibaba.com, LATAM Airlines, Avianca LifeMiles, TAP Air Portugal and Avelo Airlines.

Generated by the API Evangelist enrichment pipeline on 2026-08-01 from https://apis.io/provider/cardless.
Cardless serves a stub /llms.txt at https://docs.cardless.com/llms.txt that contains only a heading, because its documentation is gated behind a partner login.

## Access model

- Cardless is a partner-onboarded platform. There is no public sign-up for API credentials, no public OpenAPI, no public SDKs and no public sandbox credentials.
- Developer documentation at https://docs.cardless.com/ requires a partner login; every page redirects to /login.
- The production API host https://api.cardless.com/ is live and answers every unauthenticated request with HTTP 401 `{"message":"Unauthorized"}`.
- Partner authentication is an HTTP Basic call that exchanges a partner-signed JWT for a short-lived bearer access token plus a refresh token; authorization is account-scoped rather than OAuth-scope-scoped. See authentication/cardless-authentication.yml.

## APIs

- [Cardless Partner API](https://docs.cardless.com/): application submission and decisioning, account servicing, payments, transactions and disputes. Base URL https://api.cardless.com/ (gated).
- [Cardless Docs MCP Server](https://docs.cardless.com/mcp): a Mintlify-hosted Model Context Protocol server over the Cardless documentation corpus. Answers `tools/list` anonymously; exposes `search_cardless_docs`, `query_docs_filesystem_cardless_docs` and `submit_feedback`. This is a documentation-search server, not an MCP projection of the Cardless product API.

## Product surface

- [Platform](https://www.cardless.com/platform): APIs for the complete credit journey plus pre-built components — Application flow, Checkout integration, Card management, Transaction disputes.
- [Products](https://www.cardless.com/products): custom components, prebuilt modules, approvals, rewards.
- [Customers](https://www.cardless.com/customers): live co-branded programs.

## Artifacts in this repo

- mcp/cardless-mcp.yml — the published documentation MCP server, its tool list and OAuth metadata
- well-known/cardless-well-known.yml — the /.well-known probe index across all Cardless hosts
- scopes/cardless-scopes.yml — the mcp:search scope published by the docs MCP authorization server
- authentication/cardless-authentication.yml — the partner bearer-token model and the docs MCP OAuth model
- conventions/cardless-conventions.yml — identifiers, error envelope, environments, versioning
- conformance/cardless-conformance.yml — OAuth 2.0, RFC 8414, RFC 9728, PKCE, DCR, MCP 2025-06-18
- lifecycle/cardless-lifecycle.yml — versioning, deprecation, status page and changelog findings
- components/cardless-components.yml — the embeddable component surface
- security/cardless-domain-security.yml — TLS, HSTS, DNSSEC, CAA, SPF, DMARC probe results

## Docs and company

- [Documentation](https://docs.cardless.com/) (partner login required)
- [Blog](https://www.cardless.com/blog)
- [Help](https://www.cardless.com/help)
- [Careers](https://www.cardless.com/careers)
- [Terms of Service](https://legal.cardless.com/terms_of_service/default/terms_of_service.pdf)
- [Privacy Policy](https://legal.cardless.com/privacy_policy/default/privacy_policy.pdf)

## Not published

Cardless does not publish: an OpenAPI or AsyncAPI document, a webhook catalog, first-party SDKs in any public package registry, a CLI, a Postman collection, a public status page (its Statuspage instance is SSO-gated), a dated changelog, a security.txt, a vulnerability disclosure policy, a trust center or named certifications, or an A2A Agent Card.