---
title: "Create secure card details token"
method: POST
path: "/cards/{cardId}/secure-details-token"
tags: ["Cards"]
---

# Create secure card details token

`POST /cards/{cardId}/secure-details-token`

Create a token that is used as a parameter to retrieve secure card details (PAN, CVV, and PIN) or to perform PIN alterations. This token is to be retrieved by the partner and pushed to the cardholder device where the call is made. The token will be valid for 60 seconds.

## Path parameters

- `cardId` string, required

## Headers

- `X-MOD-CARD-MGMT-TOKEN` string

## Request body

- CardOneTimeTokenRequest
  - `publicKey` string — Base64 UTF-8 encoded RSA public key to be used to encrypt the token in the response. The key must be at least 4096 bits in length.
  - `purpose` 'READ' | 'UPDATE' — What the token will be used for. UPDATE tokens cannot be used for READ purposes, and READ tokens cannot be used for updates.

## Response `200`

Card token generated successfully

- CardOneTimeTokenResponse
  - `token` string, required — The token to use by the client for retrieving card details. Where 'encrypted' is true, this will be a value that must be decrypted on the client device before being used in subsequent API calls
  - `encrypted` boolean, required — Whether this token is encrypted
  - `encryptedSymmetricKey` string — Base64 UTF-8 encoded Symmetric key used to encrypt token, encrypted with client's public key. Only provided if 'encrypted' is true.
  - `initialisationVector` string — Base64 UTF-8 encoded initialisation vector used with symmetric key for encrypting the token. Only provided if 'encrypted' is true.

## Other responses

- `400` — Invalid request

---

[API](https://skmtc.net/modulrfinance/apis/modulr-api.md) · [All operations](https://skmtc.net/modulrfinance/apis/modulr-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/modulrfinance/modulr-api/versions/cbd52524c8ef/schema)