Checkout/tokenizeCnpCard

Tokenize card data from the secure iframe

Exchange raw card data for a single-use token, from inside the hosted iframe.

POST/api/v1/cnp/public/tokenization-sessions/tokenize

Browser-safeCall from the customer’s browser with a publishable key, never your secret key.

The final step of tokenization: the hosted card iframe posts the PAN here and receives a token that stands in for it everywhere else in the flow. This call originates from kepa's iframe, not your JavaScript. Raw card numbers must never pass through merchant code, which is what keeps you out of PCI scope.

Request body

application/json

clientSecretstringRequired

Example "vts_01JQXYZ_secret_example"

panstringRequired

Raw PAN. Must be submitted only from Kepa's secure card iframe.

expirystringRequired

Example "12/30"

cvcstringRequired

Example "123"

cardSchemestring

Example "VISA"

Response

application/json

tokenstring

Example "tok_12345678901234567890123456789012"

cardSchemestring

Example "VISA"

Good to know

Consumes a tokenization session created for the checkout; the token is single-use and short-lived.
If you are building a fully custom form instead of using Elements, this runs in the kepa card iframe you embed, never in your own script.

tokenizeCnpCard

curl https://api.kepapay.co/api/v1/cnp/public/tokenization-sessions/tokenize \ -H "X-Kepa-Publishable-Key: $KEPA_PUBLISHABLE_KEY" \ -H "Content-Type: application/json" \ -d '{ "clientSecret": "vts_01JQXYZ_secret_example", "pan": "string", "expiry": "12/30", "cvc": "123", "cardScheme": "VISA" }'