Allowlist Firmly in your fraud tooling

Firmly validates cards with a $0 authorization before placing an order, but a merchant’s own fraud tooling — whether it’s built into your payment processor or a separate fraud/risk service — can still reject a legitimate order. Orders placed through Firmly can look different from a shopper on your own storefront, so a strict fraud rule may block them.

If legitimate orders placed through Firmly are being fraud-blocked, add an allow rule so your fraud tooling trusts Firmly’s traffic.

​​ The allow rule

Firmly’s requests carry a recognizable identifier you can match on. In your fraud or risk tool, add an allow (allowlist) rule with this condition:

allow if user_agent = "firmly.ai <merchant secret>"

• The <merchant secret> must be at least 32 characters. You can create your own, or Firmly will provide one.
• Match on the full user_agent string so only Firmly’s traffic is allowed through.

​​ Where you set it

The exact steps depend on your payment processor or fraud provider — most expose a rules or allowlist section where you add a condition like the one above. If you’re not sure where to configure it for your provider, contact Firmly and we’ll point you to the right place.