Tokeni
APITokenization

/api/v1/tokenize

Tokenize a credit or debit card and receive an opaque token for future transactions. Card data is forwarded to the CDE vault-core via gRPC, encrypted with AES-256-GCM using a merchant-scoped DEK, and **never stored in the gateway**. The returned `tokenId` can be used in place of raw card data for all subsequent API calls (transactions, validation, detokenization). **Authentication:** `Authorization: Basic base64(apiKey:apiSecret)` **Idempotency:** Pass `X-Idempotency-Key` header to safely retry requests.

POST
/api/v1/tokenize

Tokenize a credit or debit card and receive an opaque token for future transactions.

Card data is forwarded to the CDE vault-core via gRPC, encrypted with AES-256-GCM using a merchant-scoped DEK, and never stored in the gateway.

The returned tokenId can be used in place of raw card data for all subsequent API calls (transactions, validation, detokenization).

Authentication: Authorization: Basic base64(apiKey:apiSecret)

Idempotency: Pass X-Idempotency-Key header to safely retry requests.

Authorization

basicAuth
AuthorizationBasic <token>

API Key + API Secret (Base64 encoded as apiKey:apiSecret)

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/api/v1/tokenize" \  -H "Content-Type: application/json" \  -d '{    "merchantTransactionId": "string",    "pan": "stringstrings",    "expiryMonth": "string",    "expiryYear": "string"  }'
{  "success": true,  "data": {    "tokenId": "string",    "bin": "string",    "lastFour": "string",    "cardBrand": "visa",    "cvvCached": true  },  "correlationId": "48fb4cd3-2ef6-4479-bea1-7c92721b988c"}

/v2/TransparentGatewayAPI/Detokenize POST

Transparent detokenization proxy (TokenEx-compatible). Replaces token placeholders in the body with real card data, then forwards to the destination URL.

/api/v1/detokenize POST

Retrieve original card data from a token. **Requires HMAC-SHA512 signature** in `X-Signature` header. The signature is computed over: `METHOD\nSHA512(body)\nContent-Type\nDate\nURI` using your `sharedSecret`. Returns the full PAN, expiry, cardholder name, and optionally the cached CVV. **Required headers:** - `Authorization: Basic base64(apiKey:apiSecret)` - `Date: <RFC 7231 date>` - `X-Signature: <HMAC-SHA512 signature>`