Embedded card UI
Deprecated. Use the modern embedded card flow instead: create a session with POST /v1/cards/{card_token}/embed and render it via GET /v1/embed.
Handling full card PANs and CVV codes requires that you comply with the Payment Card Industry Data Security Standards (PCI DSS). Some clients choose to reduce their compliance obligations by leveraging our embedded card UI solution documented below.
In this setup, PANs and CVV codes are presented to the end-user via a card UI that we provide, optionally styled in the customer's branding using a specified css stylesheet. A user's browser makes the request directly to api.lithic.com, so card PANs and CVVs never touch the API customer's servers while full card data is displayed to their end-users. The response contains an HTML document (see Embedded Card UI or Changelog for upcoming changes in January). This means that the url for the request can be inserted straight into the src attribute of an iframe.
<iframe id="card-iframe"
src="https://sandbox.lithic.com/v1/embed/card?embed_request=eyJjc3MiO...;hmac=r8tx1..."
allow="clipboard-write" class="content"></iframe>
You should compute the request payload on the server side. You can render it (or the whole iframe) on the server or make an ajax call from your front end code, but do not ever embed your API key into front end code, as doing so introduces a serious security vulnerability.
Query parameters
A base64 encoded JSON string of an EmbedRequest to specify which card to load.
SHA256 HMAC of the embed_request JSON string with base64 digest.
Response
The endpoint returns an HTML document similar to the one below. It is up to the API client to provide css styles for these elements in the EmbedRequest. You can always rely on the card, pan, expiry, cvv, and alert ids, as well as the pan-separator class. You shouldn't make any other assumptions about the structure of the document as it could change at any time.
Note that using the default style sheet there is no visual indication that copying is happening on-click, and you may need to add on-click styling yourself.