Tokenize the card

POST

https://{cardregistrationurl}/:CardRegistrationUrl

Send card details to a PCI-DSS-compliant tokenization server without reaching Mangopay’s servers.

The URL to use for this endpoint is returned in the CardRegistrationURL parameter on the POST Create a Card Registration endpoint.

The request must be made using the “application/x-www-form-urlencoded” content type.

Note – Do not hardcode the URL

The CardRegistrationURL is specific to each payment. You must rely on the returned URL in full (host, path, and queries) and not hardcode any part of it.

Caution – Card details must never pass via your server

For security reasons, it is strictly forbidden to send the card details to your own server. You must rely on the dedicated PCI-DSS-compliant tokenization server by using the endpoint provided.

Send card details to a PCI-DSS-compliant tokenization server without reaching Mangopay's servers. The URL to use for this endpoint is returned in the `CardRegistrationURL` parameter on the [POST Create a Card Registration](/api-reference/card-registrations/create-card-registration) endpoint. The request must be made using the “application/x-www-form-urlencoded” content type. <Note icon="fa-regular fa-circle-info"> **Note – Do not hardcode the URL** The `CardRegistrationURL` is specific to each payment. You must rely on the returned URL in full (host, path, and queries) and not hardcode any part of it. </Note> <Warning icon="fa-regular fa-triangle-exclamation"> **Caution – Card details must never pass via your server** For security reasons, it is strictly forbidden to send the card details to your own server. You must rely on the dedicated PCI-DSS-compliant tokenization server by using the endpoint provided. </Warning>

Authentication

AuthorizationBearer

Bearer authentication of the form Bearer <token>, where token is your auth token.

If your platform is using a proxy to take SCA-triggering action on behalf of users, you also need to integrate mTLS authentication and use the api-mtls base URL.

Bearer authentication of the form `Bearer <token>`, where token is your auth token. If your platform is using a [proxy](/guides/sca/proxy-management) to take SCA-triggering action on behalf of users, you also need to integrate [mTLS authentication](/guides/sca/platform) and use the `api-mtls` base URL.

Path parameters

CardRegistrationUrlstringRequired

The variable URL is only documented as a path parameter on this path for documentation reasons. I allows it to be rendered visiablly on the page, and because there are two dynamic server URLs in the spec (so both would be on the / path). The variable URL is the server for this request, and it has a variable host and path and query parameters. You do not need to add anything to it.

Request

This endpoint expects an object.

accessKeyRefstringRequired

The AccessKey returned by the POST Create a Card Registration call.

datastringRequired

The PreregistrationData returned by the POST Create a Card Registration call.

cardNumberstringRequired

The full PAN (card number) of the card.

cardExpirationDatestringRequired

The expiration date of the card in MMYY format, for example: 1229.

cardCvxstringRequired

The card verification code (CVC) or card verification value (CVV), typically 3 digits found on the back of the card. AMEX codes are 4 digits and are called card identification (CID) numbers. For cards that don't have a CVC, such as Maestro, use `000` or `999`.

Response

The string returned by the tokenization server.

Send this string in full as the RegistrationData value on the PUT Update a Card Registration endpoint to create the Card object.