---
title: "Create PAN Token"
method: POST
path: "/v1/issuing/cards/{id}/token"
tags: ["Card Secure Data"]
---

# Create PAN Token

`POST /v1/issuing/cards/{id}/token`

Creates a one-time PAN token for accessing sensitive card details through a secure iframe. This enables merchants to display card information (card number, expiry date, CVV) without PCI DSS compliance.

The token expires after 60 seconds and can only be used once.

For integration instructions, see the [Secure iFrame Guide](/card-issuance/v1.6/guide/secure-iframe-guide).

## Path parameters

- `id` string, uuid, required

## Headers

- `x-on-behalf-of` string
- `x-idempotency-key` string, uuid

## Response `200`

PAN token created successfully.

- CreatePanTokenResponse
  - `token` string, required — One-time JWT token with `pan_` prefix for accessing sensitive card details through the secure iframe.
  - `expires_in` integer, required — Token validity period in seconds.
  - `expires_at` string, required — Token expiration timestamp in ISO 8601 format.

---

[API](https://skmtc.dev/uqpay/apis/authentication-api.md) · [All operations](https://skmtc.dev/uqpay/apis/authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/uqpay/authentication-api/revisions/cef532a10777/schema)