Tokenize provided card details. Returns a token that can be used to reference the card in other API methods.

Calling this endpoint directly means handling and encrypting card data on your side, which requires a valid PCI DSS certification. Without one, use the PCI Vault iframe: it collects and encrypts the card for you and calls this endpoint itself.

This endpoint is not idempotent.

Card number needs to be stripped of any non-digit characters before encrypting. Expected pattern match is ^[1-9][0-9]{7,19}$.

We recommend validating the card number with the Luhn algorithm before encrypting it.

We don't do card brand validation during this call. Any brand will be accepted by the vault but the payment may fail if the token is used for a payment with a vendor that does not support given brand.

{
  "card_number": "ZiudIxi1h3P57k8OwmfOx1wpqIBeTGMu560uvdQoGYm2wfg/AIj8QkFpi2XTaCT4sO9drQvLSH9rSk3njQOGpSUmCzlPsA6ahG7Mg/0fMP2V6ahdMUmgmZPU1KVqL48p0pwjgSG6pTbLj6ROQFpPNkhs3ilrrQccKg7FamV34WC6hzEVyVRreR54LQeOAIFX5zQLOD4ldV/z8ikYdktKiFMkghQnF2oqzsd/rNTkL2DwzWTahgiA6gYZpoOhXt4rr1KoENC4hV4yT7iefyIFCGQu7EzeD15XB3v2+Q0Xj9ifOynADek3Mjxn6Bmg7fELGuUEkkxFgeLZrxrEcqAFbg==",
  "expiration_date": "12/30"
}

{
  "token": "f7b3b3b4-0b3d-4b3b-8b3b-3b3b3b3b3b3b",
  "created_at": "2021-03-03T16:27:54.378693Z",
  "masked_pan": "5425 **** **** 8113",
  "client_id": "f0396c8e-a87b-402d-9692-520cbc0947b5",
  "brand": "Visa"
}