---
title: "Send the account holder a code to link the card issuer"
method: POST
path: "/start-card-issuer-link"
tags: ["cards"]
---

# Send the account holder a code to link the card issuer

`POST /start-card-issuer-link`

## Request

- Base URL: `https://laso.finance`
- URL: `https://laso.finance/start-card-issuer-link`
- Auth: API key in header `Authorization`

Starts the one-time card issuer link: the card issuer sends a one-time code to the account holder. Then call `POST /verify-card-issuer-link` with the code they enter.

**The account holder, never the agent, receives and enters the code.** Send your human to their own inbox (or phone) and have them type the code into your interface. Never try to read the account holder's email or messages yourself, and never ask for their email password or access.

**Where the code goes.** An account with an email on file always gets the code at that email; `email` and `phone` are ignored for it. An account with no email (a wallet-only sign-in) must send exactly one of `email` or `phone` (E.164). The response names the destination masked, never in full.

**Limits.** Codes last 10 minutes. At most 5 codes can be sent per account in any rolling hour (`429`, with `Retry-After`). Sending a new code replaces the previous one, which then stops working.

**Prerequisite:** Laso identity verification (`403 kyc_required` otherwise, with a `kyc_url`). If the account is already linked, this answers `200` with `status: linked` and sends nothing, so calling it twice is safe.

**This route is free.**

## Headers

- `Idempotency-Key` string

## Request body

- object
  - `email` string, email: Only for an account with no email on file. The account holder's email.
  - `phone` string: Only for an account with no email on file, instead of `email`. E.164, e.g. `+15551234567`.

## Response `200`

The code was sent, or the account is already linked.

- object
  - `status` 'code_sent' | 'linked', required
  - `channel` 'email' | 'phone'
  - `sent_to` string: The destination, masked.
  - `expires_at` integer: When the code stops working, in milliseconds since the epoch.
  - `note` string, required

## Other responses

- `400`: `code: contact_required`: the account has no email on file and the body did not carry exactly one of `email` or `phone`. `code: invalid_contact`: `email` or `phone` was not a string.
- `403`: The account has not completed Laso identity verification (`code: kyc_required`). Nothing was sent. Hand `kyc_url` to the account holder, then poll `GET /get-kyc-status` until `kyc_verified` is `true`.
- `409`: A request with this `Idempotency-Key` is still being processed (`code: idempotency_key_in_progress`). Wait a moment and retry with the same key.
- `422`: The `Idempotency-Key` was already used for a different request body or route (`code: idempotency_key_reused`). Use a new key.
- `429`: `code: rate_limited`: 5 codes were already sent in the past hour. Wait `retry_after_seconds` (also in `Retry-After`).

---

[API](https://skmtc.dev/laso/apis/laso-finance-x402-api.md) · [All operations](https://skmtc.dev/laso/apis/laso-finance-x402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/laso/apis/laso-finance-x402-api/revisions/ff8ce20b49ba?raw)