Your test card

A real card, held by a real customer on the sandbox. Point your scanner at the code below: it carries the card's serial and nothing else, which is exactly what your till sends us as loyalty_id.

Scan it

Whatever the scanner reads is what you send — no prefix to strip, no envelope to unwrap:

curl -s -X POST "$CARDY_URL/customers/identify" \
  -H "Authorization: Bearer $CARDY_KEY" \
  -H "Content-Type: application/json" \
  -d '{"loyalty_id":"947706-732-680"}'

You get back the same customer the phone lookup returns, holding the same cards with the same allowed_operations. That agreement is the thing worth testing: if your scan path and your keypad path ever resolved differently, a cashier could be shown one person's balance and spend another's.

No scanner to hand?

Type the serial. loyalty_id is an opaque string to us — we have no opinion about how it reached your till.

Put it in the drawer

Print this page: the navigation, the prose and the examples drop away, and what lands on paper is the card. Leave it by the terminal and whoever is testing has a customer to scan.

Confirmed against the sandbox on 2026-08-29. We reseed rarely — but if a scan of this card ever answers CUSTOMER_NOT_FOUND, tell us. That one is ours, not yours.