Skip to main content

Get a card’s encrypted PAN and CVC

POST 
/v1/card/cards/:id/secrets

Your backend generates a 32-hex secret, wraps it RSA-OAEP under the issuer’s public key for this environment, and sends only the wrapped form. The response is AES-128-GCM ciphertext that only you can open — the service relays it and holds no key. expiryMonth/expiryYear come back in CLEAR: they are merged in from the card read, not returned by the issuer’s secrets call. Sessions are single-use; create one per reveal. Rate-limited per card.

Request​

Responses​

Success