cards

Send the account holder a code to link the card issuer

Starts the one-time card issuer link: the card issuer sends a one-time code to the account holder. Then call POST /verify-card-issuer-link with the code they enter.

The account holder, never the agent, receives and enters the code. Send your human to their own inbox (or phone) and have them type the code into your interface. Never try to read the account holder's email or messages yourself, and never ask for their email password or access.

Where the code goes. An account with an email on file always gets the code at that email; email and phone are ignored for it. An account with no email (a wallet-only sign-in) must send exactly one of email or phone (E.164). The response names the destination masked, never in full.

Limits. Codes last 10 minutes. At most 5 codes can be sent per account in any rolling hour (429, with Retry-After). Sending a new code replaces the previous one, which then stops working.

Prerequisite: Laso identity verification (403 kyc_required otherwise, with a kyc_url). If the account is already linked, this answers 200 with status: linked and sends nothing, so calling it twice is safe.

This route is free.

post/start-card-issuer-link

Request

  • Base URL: https://laso.finance
  • URL: https://laso.finance/start-card-issuer-link
  • Auth: API key in header Authorization

Headers

Idempotency-Keystring

Optional client-generated unique key (a UUID works) that makes this write safe to retry. A retry with the same key within 24 hours returns the recorded response of the original request, marked with an Idempotency-Replayed: true header, instead of performing the write again. Reusing a key with a different body or route is rejected with 422 (code: idempotency_key_reused); a retry that arrives while the original is still running gets 409 (code: idempotency_key_in_progress), so wait a moment and retry with the same key. Keys are scoped to the authenticated account.

Request body

emailstring email

Only for an account with no email on file. The account holder's email.

phonestring

Only for an account with no email on file, instead of email. E.164, e.g. +15551234567.

Response

The code was sent, or the account is already linked.

status'code_sent' | 'linked' required
channel'email' | 'phone'
sent_tostring

The destination, masked.

expires_atinteger

When the code stops working, in milliseconds since the epoch.

notestring required

Changes

No recorded changes to this operation across all 3 revisions of this API.