diff --git a/controllers/main.py b/controllers/main.py
index 4c9bd92..eb2b3a8 100644
--- a/controllers/main.py
+++ b/controllers/main.py
@@ -32,3 +32,18 @@ class AppNotificationController(http.Controller):
             'status': 'success', 
             'data': notifications
         }
+
+    @http.route('/api/loyalty/branches', type='json', auth='public', methods=['POST'], csrf=False)
+    def fetch_branches(self, **kw):
+        """
+        Public endpoint for the Flutter app to get branches without exposing API keys.
+        """
+        try:
+            branches = request.env['res.company'].sudo().search_read(
+                [('parent_id', '!=', False)],
+                ['name', 'street', 'city', 'phone'],
+                limit=50
+            )
+            return {'status': 'success', 'data': branches}
+        except Exception as e:
+            return {'status': 'error', 'message': str(e)}