📘

You can place the bearer access_token for a specific user into the Authentication section of this documentation 👉.

Cards can be created directly through the API using this PCI-compliant endpoint.

Cards can also be created through the OAuth Module by selecting the Connect New Debit Card button.

Astra authorizes the card with the issuer before returning it. When the issuer refuses the card, the response is a 400 carrying embedded_error.code of card_authorization_declined, and the same card will be refused again. When no decision was reached about the card, the response is a 429 with card_authorization_throttled or a 503 with card_authorization_unavailable, and the same request can be retried.

Cards on Discover, Diners Club, UnionPay, Maestro and private-label networks, whose card numbers begin with 6, require an enhanced client configuration. A card on one of these networks is rejected with a 403 for clients without it. Please contact customer support if you are interested in accepting them.

For Unit customers, please reference their technical documentation below to learn more about enabling card to card payments. Enabling Card to Card Payments with Unit & Astra

❗️ This resource requires the use of the secure endpoint.

Environment	Secure Endpoint
Production	https://secure.api.astra.finance/v1/cards
Sandbox	https://secure.api-sandbox.astra.finance/v1/cards

Retrying a card add. Send an optional Idempotency-Key header, unique to each card add (for example a UUID), and resend the same key, with the same request unchanged, when you retry that request. A retry with the same key within 24 hours returns the same card, as it is now, without authorizing it again. Reusing a key with a different request, such as a different card, cardholder or billing address, returns a 422. card_security_code is not compared, as a tokenized security code may differ between retries. If the first request is still being processed, a retry may return a 409 with a Retry-After header: wait that many seconds and retry. To add a card again, for example after it was removed, use a new key. Requests without the header behave as before.