Skip to main content

Get a PIN encryption key

POST 
/v1/cards/:card_id/pin-key

Returns a short-lived RSA public key to encrypt a PIN to. It is the first of two server-to-server calls that set a PIN: you encrypt the PIN to this key, then send it with POST /v1/cards/{card_id}/pin.

The key is for one card and expires after a few minutes. Ask for it when the cardholder is about to enter their PIN, not when the screen loads. It opens one PIN: once it has been sent with a PIN, whatever the outcome, it can't be used again.

Every call returns a new key. Idempotency-Key is accepted like on every other POST, but it is not used here, because a replay would hand back a key that has already been spent.

Only a physical card that is active has a PIN to set. Any other card is refused with card_invalid_state, and a closed card with card_closed.

Requires the cards:secrets scope. A program whose processor does not take a PIN by a call does not have this endpoint at all.

Request​

Responses​

The key to encrypt the PIN to.