---
title: "Create a card token"
method: POST
path: "/v1/tokens"
tags: ["TOKENS"]
---

# Create a card token

`POST /v1/tokens`

## Request

- Base URL: `https://token-sandbox.dev.clover.com`
- URL: `https://token-sandbox.dev.clover.com/v1/tokens`
- Auth: none declared. Required headers: `apikey`, `User-Agent`

Creates a single-use token, which is a unique code that indicates credit card details. Use this token with endpoints like [create a charge](https://docs.clover.com/reference/createcharge) or [pay for an order](https://docs.clover.com/reference/postordersidpay).

## Headers

- `apikey` string, uuid, required
- `User-Agent` string, required

## Request body

- object
  - `card` object: Card details, including metadata of the tokenized card. For more information, see [Create a card token](https://docs.clover.com/dev/docs/create-a-card-token).
    - `number` string, required: Card primary account number (PAN). To minimize your app's payment card industry (PCI) compliance burden, use `encrypted_pan` instead.
    - `encrypted_pan` string: Encrypted card primary account number (PAN). See [Generate a card token](https://docs.clover.com/docs/ecommerce-generating-a-card-token) for steps to encrypt card data.
    - `exp_month` string, required: Card expiration month in 2-digit format. Format: mm
    - `exp_year` string, required: Card expiration year in 2- or 4-digit format. Format: yy or yyyy
    - `cvv` string, required: Card verification value (CVV). A 3-digit value printed on a card.
    - `last4` string, required: Last 4 numbers of the primary account number.
    - `first6` string, required: First 6 numbers of the primary account number.
    - `country` string: 2-character country code.
    - `brand` 'VISA' | 'MC' | 'AMEX' | 'DISCOVER' | 'DINERS_CLUB' | 'JCB', required: Card brand.
    - `name` string: Cardholder's full name on the card.
    - `phone_number` string: Cardholder phone number in E.164 format. Passed to 3DS for enhanced fraud screening and Visa risk assessment.
    - `email` string: Cardholder email address. Passed to 3DS to improve friction-free authentication rates.
    - `address_line1` string: First line of the address. Can include the street address, PO box, or company name.
    - `address_line2` string: Second line of the address. Can include the apartment, suite, unit, or building number.
    - `address_city` string: City of the customer address. Can include district, suburb, town, or village.
    - `address_state` string: State of the customer address. Can include county, province, or region.
    - `address_zip` string: State of the customer address. Can include county, province, or region.
    - `address_country` string: Billing address country, if provided.

## Response `200`

Successful response. Card token generated.

- object
  - `id` string: Unique identification.
  - `token` string: Public source token provided by Clover.
  - `card` object: Card details, including metadata of the tokenized card.
    - `number` string: Card number.
    - `encrypted_pan` string: Encrypted card primary account number (PAN) provided by TransArmor®.
    - `exp_month` string: Card expiration month in 2-digit format. Format: mm
    - `exp_year` string: Card expiration year in 2- or 4- digit. Format: yy or yyyy
    - `cvv` string: Card verification value.
    - `last4` string: Last 4 numbers of the primary account number.
    - `first6` string: First 6 numbers of the primary account number.
    - `country` string: 2-character country code.
    - `brand` 'VISA' | 'MC' | 'AMEX' | 'DISCOVER' | 'DINERS_CLUB' | 'JCB': Card brand.
    - `id` string: Unique identifier.
    - `object` string: Object type. Objects with the same type have the same value.
    - `name` string: Cardholder's full name.
    - `address_line1` string: First line of the address. Can include the street address, PO box, or company name.
    - `address_line2` string: Second line of the address. Can include the apartment, suite, unit, or building number.
    - `address_city` string: City of the customer address. Can include district, suburb, town, or village.
    - `address_state` string: State of the customer address. Can include county, province, or region.
    - `address_zip` string: State of the customer address. Can include county, province, or region.
    - `address_country` string: Billing address country, if provided.
    - `cvc_check` 'pass' | 'fail' | 'unavailable' | 'unchecked': Results of the card verification code (CVC) check when a card payment is submitted to a card network for authorization. The card issuer checks the CVC against the information on file for the cardholder.
  - `client_ip` string: Internet protocol (IP) address of the client generating the token.
  - `created` integer: Time the token object was created.
  - `livemode` boolean: Indicates whether the token object is live in production. Values: True - Token object is in production. False - Token object is in sandbox.
  - `type` 'card' | 'wallet (Google Pay or Apple Pay)': Token type.
  - `used` boolean: Indicates whether the token is already used. Note that tokens can be used only once.

## Other responses

- `400`: Bad request.
- `401`: Authorization information is missing or invalid.
- `5XX`: Unexpected error.

---

[API](https://skmtc.dev/clover/apis/card-tokenization-service-api.md) - [All operations](https://skmtc.dev/clover/apis/card-tokenization-service-api/llms.txt) - [OpenAPI document](https://skmtc.dev/clover/apis/card-tokenization-service-api/revisions/2638d0447481?raw)