Cards

A card is used to make payments from an associated account. Each card follows a defined lifecycle from creation to closure or expiry.

Card data and PCI scope

The full card number and CVV are never included in normal API responses, and issuing a card does not send either value to your servers. last_four appears once the card has been issued, when the processor reports it.

Showing the full card number is a server-to-server call. You send a public key, and we return the card number and security code encrypted to it. Only the holder of the matching private key can read them, so your backend relays ciphertext it cannot read.

This keeps your infrastructure outside PCI DSS cardholder-data scope, as long as the private key and the decryption stay on the cardholder's device or somewhere else that card data is allowed. A server that decrypts the number is in scope. See displaying PAN and CVV securely and PCI DSS scope.

In this section

• Issuing a virtual card — the quickest way to issue a card
• Issuing a physical card — request a printed card for a virtual one, or issue one directly
• PIN management — set the PIN of a physical card from a PIN encrypted on the device
• Card lifecycle — all card states and transitions
• Freeze, replace, close — the actions support teams use most, including which ones are permanent
• Displaying PAN and CVV securely — show sensitive card details, encrypted until they reach the device