---
title: "Complete the card issuer link with the account holder's code"
method: POST
path: "/verify-card-issuer-link"
tags: ["cards"]
---

# Complete the card issuer link with the account holder's code

`POST /verify-card-issuer-link`

## Request

- Base URL: `https://laso.finance`
- URL: `https://laso.finance/verify-card-issuer-link`
- Auth: API key in header `Authorization`

Completes the link with the one-time code the account holder received from `POST /start-card-issuer-link`. No session id is needed: the pending code is held per account, and only the newest one works.

**The account holder, never the agent, receives and enters the code.** Send your human to their own inbox (or phone) and have them type the code into your interface. Never try to read the account holder's email or messages yourself, and never ask for their email password or access.

**Consent.** Completing the link records the account holder's consent with the card issuer. Show them the card issuer's connection disclosure next to the code input, and send `consent_accepted: true` only once they have accepted it.

**Wrong codes.** An incorrect code answers `400 invalid_code` with `attempts_left`; the account holder can try again. After 5 incorrect entries, or once the code is 10 minutes old, it is discarded and a new one must be sent.

If the account is already linked this answers `200` with `status: linked`, so a retry after a lost response is safe. After linking, `GET /get-card-issuer-status` reads `linked`.

**This route is free.**

## Headers

- `Idempotency-Key` string

## Request body

- object
  - `code` string, required: The one-time code exactly as the account holder entered it (digits).
  - `consent_accepted` true, required: The account holder has seen and accepted the card issuer's connection disclosure.

## Response `200`

Linked.

- object
  - `status` 'linked', required
  - `note` string, required

## Other responses

- `400`: `code: invalid_code`: the code is wrong; `attempts_left` says how many tries remain, and `terminal: true` means none do. `code: code_expired` / `no_code_sent`: there is no usable code; send a new one. `code: invalid_code_format` / `consent_required`: fix the request body.
- `403`: The account has not completed Laso identity verification (`code: kyc_required`). Nothing was sent. Hand `kyc_url` to the account holder, then poll `GET /get-kyc-status` until `kyc_verified` is `true`.
- `409`: `code: linked_elsewhere`: the card issuer account behind this code is already linked to a different Laso account, and the account holder must unlink it there first. Also `code: idempotency_key_in_progress` when a request with this `Idempotency-Key` is still running.
- `422`: The `Idempotency-Key` was already used for a different request body or route (`code: idempotency_key_reused`). Use a new key.
- `429`: `code: too_many_attempts`: the code was discarded after too many incorrect entries. Send a new one with `POST /start-card-issuer-link`.

---

[API](https://skmtc.dev/laso/apis/laso-finance-x402-api.md) · [All operations](https://skmtc.dev/laso/apis/laso-finance-x402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/laso/apis/laso-finance-x402-api/revisions/ff8ce20b49ba?raw)