---
title: "Create Card"
method: POST
path: "/cards"
tags: ["Cards"]
---

# Create Card

`POST /cards`

## Request

- Base URL: `https://api.meow.com/v1`
- URL: `https://api.meow.com/v1/cards`
- Auth: API key in header `x-api-key`
- TypeScript: <https://skmtc.dev/meow/apis/meow-api/docs/cards/post.ts> (a function with typed inputs; its response is checked against the schema)

Creates a virtual card with a spend limit. By default the card authorizes at any merchant up to that limit. Pass `spending_restriction` with merchant IDs from `GET /cards/merchants` to restrict it, and `allowed_categories` to restrict by merchant category. Set `single_use` to `true` (default) for a one-shot card that auto-cancels after the first approved authorization, or `false` for a multi-use card that stays active until expiry or explicit revoke. Retrieve the PAN by calling `POST /cards/{card_id}/pan`.

## Headers

- `Idempotency-Key` string, nullable: A unique key you generate (1-50 printable ASCII characters, no spaces) so retrying this request never creates a duplicate. Reusing a key is rejected.
- `x-entity-id` string, uuid

## Request body

- CreateCardRequest
  - `spending_controls` SpendingControls, required
    - `per_transaction_limit` integer, required: Per-transaction spend limit in whole dollars. It can't exceed your entity's limit for agent cards, which is $25,000 unless Meow has set a different one.
    - `daily_limit` integer, nullable: Daily spend limit in whole dollars, resetting at midnight UTC.
    - `weekly_limit` integer, nullable: Weekly spend limit in whole dollars, resetting Sunday at midnight UTC.
    - `monthly_limit` integer, nullable: Monthly spend limit in whole dollars, resetting on the 1st at midnight UTC.
    - `yearly_limit` integer, nullable: Yearly spend limit in whole dollars, resetting January 1st at midnight UTC.
    - `all_time_limit` integer, nullable: Lifetime spend limit in whole dollars. It never resets.
  - `nickname` string, required: Display name for the card (max 30 characters).
  - `spending_restriction` CardSpendingRestrictionRequest
    - `type` 'allow' | 'block', required
    - `merchants` string[], required: Merchant IDs from `GET /cards/merchants`. When `type` is `allow` the card authorizes only at these merchants; when `block` it is refused at them and allowed everywhere else.
  - `allowed_categories` CardTransactionCategory[], nullable: Restrict the card to these merchant categories.
  - `debit_account` string, nullable: The account this card draws from, as a `cash_account_` id from List Accounts. It must be one of your own open accounts. Omit to use the account this entity issues cards from by default.
  - `purpose` string, nullable: A memo for your own records, recorded on the card's audit trail. It is never sent to the issuer or the merchant, so it does not appear on a statement and does not restrict what the card can buy.
  - `expires_at` string, date-time: ISO 8601 date-time in the format `YYYY-MM-DDThh:mm:ss.nnn[Z|[+|-]hh:mm]` (per [IETF RFC 3339](https://xml2rfc.tools.ietf.org/public/rfc/html/rfc3339.html#anchor14)).
  - `single_use` boolean: If `true`, the card is revoked automatically after the first authorization. If `false`, the card stays usable until expiry or explicit revoke.

## Response `200`

Successful Response

- CreateCardResponse
  - `payment_type` 'card': Always `card`, so you can tell this apart from a payment token response.
  - `controls` CardControls, required
    - `spending_controls` SpendingControls, required
      - `per_transaction_limit` integer, required: Per-transaction spend limit in whole dollars. It can't exceed your entity's limit for agent cards, which is $25,000 unless Meow has set a different one.
      - `daily_limit` integer, nullable: Daily spend limit in whole dollars, resetting at midnight UTC.
      - `weekly_limit` integer, nullable: Weekly spend limit in whole dollars, resetting Sunday at midnight UTC.
      - `monthly_limit` integer, nullable: Monthly spend limit in whole dollars, resetting on the 1st at midnight UTC.
      - `yearly_limit` integer, nullable: Yearly spend limit in whole dollars, resetting January 1st at midnight UTC.
      - `all_time_limit` integer, nullable: Lifetime spend limit in whole dollars. It never resets.
    - `single_use` boolean, required: Whether the card is single-use.
    - `expires_at` string, date-time: ISO 8601 date-time in the format `YYYY-MM-DDThh:mm:ss.nnn[Z|[+|-]hh:mm]` (per [IETF RFC 3339](https://xml2rfc.tools.ietf.org/public/rfc/html/rfc3339.html#anchor14)).
    - `spending_restriction` CardSpendingRestriction
      - `type` 'allow' | 'block', required
      - `merchants` string[], required: Merchant names in the restriction list.
  - `metadata` CardMetadata, required
    - `card_id` string, uuid, required: Identifier for the issued card.
    - `purpose` string, nullable: Echoes the purpose from your request, if you sent one.
    - `debit_account` string, required: The account this card draws from, whether you named one or the default was used.

## Other responses

- `400`: The request could not be processed.
- `401`: Authentication failed.
- `403`: The API key is not authorized for this operation, or the user of a global API key is an admin or controller without approved KYC. The KYC case returns the message `KYC is required for controllers and admins.` until that user completes KYC in the Meow dashboard.
- `429`: Too many requests.

---

[API](https://skmtc.dev/meow/apis/meow-api.md) - [All operations](https://skmtc.dev/meow/apis/meow-api/llms.txt) - [OpenAPI document](https://skmtc.dev/meow/apis/meow-api/revisions/ea2d7e25b63b?raw)