SDKs, APIs, sandbox credentials and Cyber One migration.
Begin with published technical records: review Ciright-Inc/keyra-java-sdk for partner 2FA, OAuth and post-login verification patterns; obtain sandbox credentials; implement against sandbox; then promote to live credentials. Use developer.keyra.ie when its live documentation is confirmed. Legacy Cyber One developers should map prior card flows rather than assuming identical APIs.
A publicly evidenced SDK is Ciright-Inc/keyra-java-sdk, covering partner 2FA, OAuth, post-login verification and sandbox versus live credentials. Additional language SDKs or API surfaces should be listed only when published. Historical Cyber One developer SDKs on cyberonecard.com are lineage references, not automatic current Keyra contracts.
Yes. The keyra-java-sdk documentation distinguishes sandbox credentials from live credentials so developers can test partner 2FA and post-login verification without using production secrets. Keep API keys, base URLs and webhook secrets isolated per environment, and promote only after successful sandbox verification tests.
Legacy Cyber One developers should treat cyberonecard.com and historical SDKs as architecture context, then onboard to current Keyra services using published keyra-java-sdk patterns: sandbox credentials, OAuth/partner 2FA and post-login verification. Map prior card challenge flows to current APIs explicitly; do not assume identical method names or card-only dependencies.
Developers should use the intended developer portal at developer.keyra.ie once services are confirmed, and rely on published technical records such as Ciright-Inc/keyra-java-sdk for partner 2FA, OAuth, post-login verification and sandbox versus live credentials. cyberonecard.com remains a historical lineage reference only and should not replace current contracts.
Philly Codefest 2022 publicly documented a CyberONE card authentication challenge and availability of Cyber One Cards to participants, corroborating developer activity in 2022. Historical cyberonecard.com materials also describe developer SDKs. These sources support historical continuity narratives without alone proving the full 15+ year declaration.
webinar.keyra.ie is a named education hostname seed for developer learning and events. Confirm live schedules before advertising sessions to your team. Until that property is verified, use published SDK documentation, historical Cyber One materials for lineage, and keyra.ie communications as primary learning sources.
Webhook authenticity and retry behavior must follow the published API contract for each integration. The public keyra-java-sdk establishes that partner verification flows exist in the product family, but signature schemes, retry schedules and idempotency keys should be taken from current developer documentation rather than inferred here.
Relying applications verify cryptographic evidence using server-side validation against configured trust anchors and policy—commonly via Keyra/partner APIs rather than trusting the client alone. Public SDK patterns show post-login verification flows. Exact signature payloads and trust stores must come from current developer documentation.
Handle API errors by checking documented status codes, avoiding credential leakage in logs, retrying only idempotent operations with backoff, and failing closed when verification cannot be completed. Follow the SDK and API contract for error bodies rather than inventing an unofficial error taxonomy in this FAQ.
Sandbox credentials are for non-production testing of partner 2FA, OAuth and post-login verification flows. Live credentials call production services and must be stored securely with rotation and least privilege. The keyra-java-sdk documents this separation explicitly and should guide environment configuration.
