v1

latestOpenAPI 3.0.22026-07-26123510445.2 KB

Card Secure Data

Create PAN Token

Creates a one-time PAN token for accessing sensitive card details through a secure iframe. This enables merchants to display card information (card number, expiry date, CVV) without PCI DSS compliance.

The token expires after 60 seconds and can only be used once.

For integration instructions, see the Secure iFrame Guide.

post/v1/issuing/cards/{id}/token

Path parameters

idstring uuid required

Example:b3d9d2d5-4c12-4946-a09d-953e82sed2b0

Universally unique identifier (UUID v4) of a resource.

Headers

x-on-behalf-ofstring

Specifies the sub-account on whose behalf the request is made. This should be set to the account_id, which can be retrieved via the List Connected Accounts API. If omitted or empty, the request is executed using the master account. More information at Connected Accounts.

x-idempotency-keystring uuid

A unique identifier (UUID) used to maintain operation idempotency, ensuring that repeated executions of the same operation do not result in unintended effects or duplication. It helps preserve data consistency in the face of network errors, retries, or failures.

Response

PAN token created successfully.

tokenstring required

One-time JWT token with pan_ prefix for accessing sensitive card details through the secure iframe.

expires_ininteger required

Token validity period in seconds.

expires_atstring required

Token expiration timestamp in ISO 8601 format.

Example response

{
  "token": "pan_eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9",
  "expires_in": 60,
  "expires_at": "2025-11-13T10:31:00Z"
}