Tokenize card

Exchange raw cardholder data for a short-lived token that can be passed to authorize-payment.

This endpoint is hosted on a PCI-isolated domain and must be called directly with the cardholder’s PAN, CVV, and expiration date. Only operators with their own PCI DSS compliance should call this endpoint directly.

POST /tokenize

Tokenize card

cURL

curl --request POST \
  --url https://tokens.pushcash.com/tokenize \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "user_id": "user_28CJjV7P4Go5PNJvfzghiD",
  "pan": "5555555555554444",
  "cvv": "123",
  "exp_month": "12",
  "exp_year": "28",
  "type": "card_only"
}
'

200

{
  "token": "token_mbDRHFi3dxIZEtykHsgUGC"
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json

user_id · string · required

The Push identifier for the user the token will be associated with.

Example:

"user_28CJjV7P4Go5PNJvfzghiD"

pan · string · required

The cardholder's primary account number (PAN).

Example:

"5555555555554444"

cvv · string · required

The card verification value.

Example:

"123"

exp_month · string · required

The two-digit card expiration month.

Example:

"12"

exp_year · string · required

The two-digit card expiration year.

Example:

"28"

type · enum<string>

Optional processing type override to set payments processed using the token to card-only. If omitted, the processing type is dynamically assigned based on the processing category and bin type (card_only vs. secure_debit).

Available options: card_only

Example:

"card_only"

Response

200

application/json

Token created successfully

token · string · required

A short-lived token that can be submitted to /authorize to process a payment.

Example:

"token_mbDRHFi3dxIZEtykHsgUGC"