---
title: "Extract Card From Image"
method: POST
path: "/tokenize/extract-card"
tags: ["cardTokenization"]
---

# Extract Card From Image

`POST /tokenize/extract-card`

Extract the card details from a photo of a physical card and tokenize them.

This allows a customer to take a photo of their credit/debit card and have
the card details auto-populated during checkout instead of typing them in
manually. The card is extracted and stored as a token in Coinflow's
PCI-compliant vault, and the resulting token is returned so it can be used
in the cards endpoint.

In order to gain access to this endpoint your company must have PCI-DSS
certification, and provide that to your Coinflow Integrations Representative.

## Headers

- `Authorization` string, required

## Request body

- ExtractCardRequest
  - `image` string — A base64-encoded image of the physical card to extract details from. Note: This is only for documentation purposes, this endpoint returns an HTTP redirect where the card image should be sent.
  - `mimeType` string — The MIME type of the provided image. Defaults to image/jpeg. Note: This is only for documentation purposes, this endpoint returns an HTTP redirect where the card image should be sent.

## Response `200`

Ok

- ExtractCardResponse
  - `token` string, required — The token representing the extracted card. Use this token in the cards endpoint to complete the checkout.
  - `firstSix` string, required — The first six digits of the extracted card number.
  - `lastFour` string, required — The last four digits of the extracted card number.
  - `expirationMonth` string, nullable, required — The extracted card expiration month, if available.
  - `expirationYear` string, nullable, required — The extracted card expiration year, if available.
  - `cvvCaptured` boolean, required — Whether a CVV/CVC was captured from the image and stored with the token.
  - `cvvHash` string, nullable, required — SHA-256 hex hash of the captured CVV/CVC. Compare against the hash of the CVV you expect to verify the correct value was extracted, without handling the raw CVV. Null when no CVV was captured.

---

[API](https://skmtc.net/coinflow/apis/api-reference.md) · [All operations](https://skmtc.net/coinflow/apis/api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/coinflow/api-reference/revisions/c0201d849baf/schema)