Checkout/tokenizeCnpCard

Tokenize card data from the secure iframe

Exchange raw card data for a single-use token, from inside the hosted iframe.

POST/api/v1/cnp/public/tokenization-sessions/tokenize

Browser-safeCall from the customer’s browser with a publishable key — never your secret key.

The final step of tokenization: the hosted card iframe posts the PAN here and receives a token that stands in for it everywhere else in the flow. This call originates from kepa's iframe, not your JavaScript — raw card numbers must never pass through merchant code, which is what keeps you out of PCI scope.

Request body

application/json

clientSecretstringRequired

Example "vts_01JQXYZ_secret_example"

panstringRequired

Raw PAN. Must be submitted only from Kepa's secure card iframe.

expirystringRequired

Example "12/30"

cvcstringRequired

Example "123"

cardSchemestring

Example "VISA"

Response

application/json

tokenstring

Example "tok_12345678901234567890123456789012"

cardSchemestring

Example "VISA"

Good to know

Consumes a tokenization session created for the checkout; the token is single-use and short-lived.
If you are building a fully custom form instead of using Elements, this runs in the kepa card iframe you embed — never in your own script.

tokenizeCnpCard

curl https://api.kepapay.co/api/v1/cnp/public/tokenization-sessions/tokenize \ -H "X-Kepa-Publishable-Key: $KEPA_PUBLISHABLE_KEY" \ -H "Content-Type: application/json" \ -d '{ "clientSecret": "vts_01JQXYZ_secret_example", "pan": "string", "expiry": "12/30", "cvc": "123", "cardScheme": "VISA" }'