---
title: "Create a card tokenization session"
method: POST
path: "/transaction/tokenizeSession"
tags: ["transactions"]
---

# Create a card tokenization session

`POST /transaction/tokenizeSession`

## Request

- Base URL: `https://api.ontraport.com/1`
- URL: `https://api.ontraport.com/1/transaction/tokenizeSession`
- Auth: none declared

Returns a one-time tokenization session for sending credit card data to Ontraport's PCI-secured domain instead of to this API. POST your card fields together with the returned <b>aid</b> and <b>hash</b> to the returned <b>url</b> (form-encoded: <b>payment_number</b>, <b>payment_code</b>, <b>payment_expire_month</b>, <b>payment_expire_year</b>, and, to refresh the security code of a saved card instead, <b>cvc_only=1</b> with <b>payment_number=cvconly</b> — a literal placeholder the tokenizer requires — and <b>payment_code</b>). The response is a short-lived, single-use token to pass as <b>payer[pci_card_token]</b> (or <b>payer[pci_cvc_token]</b> for the CVC-only form) to <b>transaction/processManual</b> or <b>transaction/payInvoice</b>. Use the hash within <b>expires_in</b> seconds; each hash and each token is valid for one tokenization and one charge respectively. Raw card fields in API calls are deprecated in favor of this flow.

## Response `200`

Tokenization session created

- Response
  - `code` integer, required
  - `data` object, required
  - `account_id` integer, required

## Changes

- **2026-09-09** `88abd6cd8a5f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/ontraport/apis/ontraport-api/changes/transaction/tokenizeSession/post.md)

---

[API](https://skmtc.dev/ontraport/apis/ontraport-api.md) - [All operations](https://skmtc.dev/ontraport/apis/ontraport-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ontraport/apis/ontraport-api/revisions/4c878a9f93aa?raw)