Card

Create card embed session

Changed on

Creates a short-lived session for displaying card details or setting a card PIN in Lithic-hosted iframes. Create the session on your backend to not expose your API key in browser code.

A session token can only be used to reveal card details (per embed type) or submit a pin a single time. Attempting to re-use session tokens will result in 401's.

post/v1/cards/{card_token}/embed

Request

  • Base URL
    https://sandbox.lithic.com
  • URL
    https://sandbox.lithic.com/v1/cards/{card_token}/embed
  • Auth
    API key in header Authorization

Path parameters

card_tokenstring uuid required

Request body

type'CARD_EMBED' | 'PIN_SETTING_EMBED' required

The type of card embed session to create.

CARD_EMBED sessions can load PAN, CVV, EXP_MONTH, and EXP_YEAR iframes.

PIN_SETTING_EMBED sessions can load only the PIN_SETTING iframe.

expirationinteger

Unix timestamp at which the session expires. The value must be in the future and no more than 10 minutes after the request. If omitted, the session expires 10 minutes after the request.

max_pin_lengthinteger

Maximum number of digits accepted by a PIN_SETTING_EMBED. The value must be from 4 through 8 and defaults to 8. This parameter is not supported for CARD_EMBED sessions and will be rejected

target_originstring uri required

Canonical HTTPS origin of the page that will embed the iframe. Lithic embeds will verify the target_origin against the parent application's origin. The origin must not contain a path, query parameters, fragment, or credentials.

Example request

{
  "type": "CARD_EMBED",
  "max_pin_length": 4,
  "target_origin": "https://example.com"
}

Response

A short-lived card embed session.

sessionstring required

Opaque, short-lived credential used to load card embed iframes. Treat this value as sensitive. Do not log, persist, include in analytics, or share it.

Example response

{
  "session": "eyJhb..."
}

Changes