kepa
Checkout/createCnpCheckoutTokenizationSession

Create a browser tokenization session

Open a short-lived, PCI-scoped session for the card iframe to tokenize into.

POST/api/v1/cnp/public/checkout-sessions/{id}/tokenization-session
Browser-safeCall from the customer’s browser with a publishable key — never your secret key.
Before the customer's card details can be captured, the kepa-hosted card iframe needs a tokenization session to submit them to. This mints one, scoped to the checkout's merchant and customer, so the raw PAN goes to the vault and never to your page or your server.
Path parameters
idstringRequired

Checkout session identifier.

Request body

application/json

clientSecretstringRequired
Example "cs_7c1b9b86_secret_example"

Response

application/json

clientSecretstring
Example "vts_01JQXYZ_secret_example"
expiresAtstring · ISO 8601
Example "2026-04-09T09:14:22Z"
Good to know
  • The tokenization session lives for 15 minutes. Create it when the form is ready to accept input, not on page load.
  • The checkout session must be OPEN and unexpired, or this returns 409.
  • Returns 503 if the token vault is not provisioned for the merchant — a configuration state, not a client error.
  • You rarely call this directly: elements().create('dropin') manages it for you.

createCnpCheckoutTokenizationSession

POSTGo API
https://api.kepapay.co/api/v1/cnp/public/checkout-sessions/{id}/tokenization-session
Request
curl https://api.kepapay.co/api/v1/cnp/public/checkout-sessions/{id}/tokenization-session \
  -H "X-Kepa-Publishable-Key: $KEPA_PUBLISHABLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "clientSecret": "cs_7c1b9b86_secret_example"
}'
Response
{
  "clientSecret": "vts_01JQXYZ_secret_example",
  "expiresAt": "2026-04-09T09:14:22Z"
}