Quickstart

1. Get sandbox keys

1. Open sandbox-dashboard.tokeni.io.
2. Create an API key. Copy the key and secret once. The secret is not shown again.
3. Optional: restrict the key to your office or CI IPs.

Production keys live on dashboard.tokeni.io. Do not send live cardholder data to sandbox.

2. Call sandbox

Authenticate with HTTP Basic: apiKey:apiSecret, Base64 encoded.

curl -sS https://sandbox-api.tokeni.io/api/v1/usage/current \
  -u "$TOKENI_API_KEY:$TOKENI_API_SECRET"

You should get a JSON envelope with success and a correlationId. Save the correlation ID when something fails. Support can look it up. We never log the PAN.

3. Collect a card

Do not post a PAN from your browser or a non-PCI server. Use hosted fields. The iframe returns a token ID. You store that.

If you already run a PCI environment and must tokenize server to server, use POST /api/v1/tokenize. Prefer hosted fields.

4. Charge the token

curl -sS https://sandbox-api.tokeni.io/api/v1/transaction/$TOKENI_API_KEY/debit \
  -u "$TOKENI_API_KEY:$TOKENI_API_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"tokenId":"tok_...","amount":"10.00","currency":"USD"}'

Detokenize and some vault writes also need an HMAC-SHA512 X-Signature. See Authentication.

Environments

Try-it in the API reference defaults to sandbox. Do not paste live PANs into the playground.