---
title: "Generate an Ephemeral Key to Reveal Card Details"
method: POST
path: "/customers/{customerID}/card_accounts/{cardAccountID}/ephemeral_keys"
tags: ["Cards"]
---

# Generate an Ephemeral Key to Reveal Card Details

`POST /customers/{customerID}/card_accounts/{cardAccountID}/ephemeral_keys`

## Request

- Base URL: `https://api.bridge.xyz/v0`
- URL: `https://api.bridge.xyz/v0/customers/{customerID}/card_accounts/{cardAccountID}/ephemeral_keys`
- Auth: API key in header `Api-Key`

Generates a one-time ephemeral key that can be used to reveal card details. Please see the integration guide on [safely revealing card details](https://apidocs.bridge.xyz/docs/safely-reveal-card-details-to-customers) for more information.

## Path parameters

- `customerID` string, required: A UUID that uniquely identifies a resource
- `cardAccountID` string, uuid, required

## Headers

- `Idempotency-Key` string, required

## Request body

- PostCardAccountEphemeralKeyInput: The request to create an ephemeral key to reveal card details
  - `client_nonce` string, required: The client-side nonce that will be associated with the ephemeral key. This must be generated from the client secret and timestamp as per the [integration guide](https://apidocs.bridge.xyz/docs/safely-reveal-card-details-to-customers) in order to be usable for revealing card details.

## Response `200`

Ephemeral key to reveal card details

- CardAccountEphemeralKeyResponse: A response containing the ephemeral key to reveal card details
  - `ephemeral_key` string, required: The ephemeral key to reveal card details. This key is only valid for 5 minutes. Your backend should return this key to the frontend instead of directly using it, to avoid putting your backend in PCI compliance scope. Please see the integration guide on [safely revealing card details](/platform/cards/additional/safely-reveal-card-details) for more information.

## Other responses

- `400`: Request containing missing or invalid parameters.
- `401`: Missing or invalid API key
- `500`: Unexpected error. User may try and send the request again.

---

[API](https://skmtc.dev/bridge/apis/bridge-api.md) - [All operations](https://skmtc.dev/bridge/apis/bridge-api/llms.txt) - [OpenAPI document](https://skmtc.dev/bridge/apis/bridge-api/revisions/a390532e9fc6?raw)