Payment tokens

Use payment tokens to reduce the scope of PCI DSS compliance.

A payment token can be made using a different authentication scheme (public key authentication), which enables you to create a payment token directly from the browser. This bypasses the need to send sensitive cardholder info to your servers. We recommend using this with the FramePay library, which helps you integrate a form into this API resource and create payment tokens.

Operations

Create a payment token

Request

Creates a payment token which can be exchanged into a payment instrument. FramePay is the recommended way to create a payment token because it minimizes PCI DSS compliance. Once a payment token is created, it can only be used once.

A payment token expires upon first use or within 30 minutes of the token creation, whichever comes first.

Security
PublishableApiKey or SecretApiKey or JWT
Bodyapplication/jsonrequired

Payment token resource.

methodstringrequired

Payment method of the token.

Value:"payment-card"
Discriminator
paymentInstrumentobjectrequired

Payment card instrument details.

billingAddressobject(ContactObject)

Billing address object. This value is required to perform payments. For payment-card updates, billingAddress can be ignored.

riskMetadataRisk metadata (object) or null
One of:

Risk metadata used for 3D Secure and risk scoring.

leadSourceobject(LeadSource)write-only

Lead source information.

curl -i -X POST \
  https://www.rebilly.com/_mock/catalog/all/tokens \
  -H 'Authorization: YOUR_API_KEY_HERE' \
  -H 'Content-Type: application/json' \
  -d '{
    "method": "payment-card",
    "paymentInstrument": {
      "pan": "string",
      "cvv": "string",
      "encryptedCvv": "stringstringstringstringstringstringstringstringstringstringstringstringstringstringstringstringstri",
      "expMonth": 0,
      "expYear": 0
    },
    "billingAddress": {
      "firstName": "Benjamin",
      "lastName": "Franklin",
      "organization": "Rebilly",
      "address": "36 Craven St",
      "address2": "string",
      "city": "Austin",
      "region": "Texas",
      "country": "GB",
      "postalCode": "WC2N 5NF",
      "phoneNumbers": [
        {
          "label": "main",
          "value": "1-512-777-0269",
          "primary": true
        }
      ],
      "emails": [
        {
          "label": "main",
          "value": "rebilly@example.com",
          "primary": true
        }
      ],
      "dob": "1980-04-01",
      "jobTitle": "CEO"
    },
    "id": "4f6cf35x-2c4y-483z-a0a9-158621f77a21",
    "riskMetadata": {
      "ipAddress": "93.92.91.90",
      "fingerprint": "pIUt3xbgX3l9g3YDiLbx",
      "httpHeaders": {
        "Content-Type": "application/json",
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"
      },
      "browserData": {
        "colorDepth": 24,
        "isJavaEnabled": true,
        "language": "en-US",
        "screenWidth": 1920,
        "screenHeight": 1080,
        "timeZoneOffset": 300,
        "isAdBlockEnabled": true
      },
      "extraData": {
        "kountFraudSessionId": "abcdefg12345abababab123456789012",
        "payPalMerchantSessionId": "dd65ratxc5qv15iph3vyoq7l6davuowa",
        "threatMetrixSessionId": "dd65ratxc5qv15iph3vyoq7l6davuowadd65ratxc5qv15iph3vyoq7l6davuowa"
      }
    },
    "leadSource": {
      "medium": "string",
      "source": "string",
      "campaign": "string",
      "term": "string",
      "content": "string",
      "affiliate": "string",
      "subAffiliate": "string",
      "salesAgent": "string",
      "clickId": "string",
      "path": "string",
      "referrer": "https://www.rebilly.com"
    }
  }'

Responses

Token created.

Headers
Locationstring, (uri)

Location of the related resource.

Example:"https://api.rebilly.com/example"
X-RateLimit-Limitinteger

Total number of rate limit tokens for this request within a rate limit period. For more information, see Rate limits.

Example:3600
X-RateLimit-Remaininginteger

Remaining number of rate limit tokens for this request within the rate limit period. For example, in the sandbox environment, rate limits for non-GET endpoints are set at 3000 requests per 10 minutes.

Example:3600
Bodyapplication/json
methodstringrequired

Payment method of the token.

Value:"payment-card"
Discriminator
paymentInstrumentobjectrequired

Payment card instrument details.

billingAddressobject(ContactObject)

Billing address object. This value is required to perform payments. For payment-card updates, billingAddress can be ignored.

idstring, <= 50 characters(ResourceId)read-only

ID of the token.

Example:"4f6cf35x-2c4y-483z-a0a9-158621f77a21"
isUsedbooleanread-only

Specifies if the token has been used.

Default:false
riskMetadataRisk metadata (object) or null
One of:

Risk metadata used for 3D Secure and risk scoring.

createdTimestring, (date-time)(CreatedTime)read-only

Date and time when the resource is created. This value is set automatically when the resource is created.

updatedTimestring, (date-time)(UpdatedTime)read-only

Date and time when the resource is updated. This value is set automatically when the resource is updated.

usageTimestring or null, (date-time)read-only

Date and time when the token is used.

expirationTimestring or null, (date-time)read-only

Date and time when the token expired.

Response
{
  "method": "payment-card",
  "paymentInstrument": {
    "encryptedCvv": "stringstringstringstringstringstringstringstringstringstringstringstringstringstringstringstringstri",
    "expMonth": 0,
    "expYear": 0,
    "bin": "string",
    "last4": "string",
    "brand": "Visa"
  },
  "billingAddress": {
    "firstName": "Benjamin",
    "lastName": "Franklin",
    "organization": "Rebilly",
    "address": "36 Craven St",
    "address2": "string",
    "city": "Austin",
    "region": "Texas",
    "country": "GB",
    "postalCode": "WC2N 5NF",
    "phoneNumbers": [ … ],
    "emails": [ … ],
    "dob": "1980-04-01",
    "jobTitle": "CEO",
    "hash": "056ae6d97c788b9e98b049ebafd7b229bf852221"
  },
  "id": "4f6cf35x-2c4y-483z-a0a9-158621f77a21",
  "isUsed": false,
  "riskMetadata": {
    "ipAddress": "93.92.91.90",
    "fingerprint": "pIUt3xbgX3l9g3YDiLbx",
    "httpHeaders": { … },
    "browserData": { … },
    "extraData": { … },
    "isProxy": true,
    "isVpn": true,
    "isTor": true,
    "isHosting": true,
    "hostingName": "string",
    "isp": "string",
    "country": "US",
    "region": "NY",
    "city": "New York",
    "latitude": 0.1,
    "longitude": 0,
    "postalCode": "string",
    "timeZone": "America/New_York",
    "accuracyRadius": 0,
    "distance": 0,
    "hasMismatchedBillingAddressCountry": true,
    "hasMismatchedBankCountry": true,
    "hasMismatchedTimeZone": true,
    "hasMismatchedHolderName": true,
    "hasFakeName": true,
    "isHighRiskCountry": true,
    "paymentInstrumentVelocity": 0,
    "declinedPaymentInstrumentVelocity": 0,
    "deviceVelocity": 0,
    "ipVelocity": 0,
    "emailVelocity": 0,
    "billingAddressVelocity": 0,
    "paymentInstrumentApprovedTransactionCount": 0,
    "score": 0
  },
  "createdTime": "2019-08-24T14:15:22Z",
  "updatedTime": "2019-08-24T14:15:22Z",
  "usageTime": "2019-08-24T14:15:22Z",
  "expirationTime": "2019-08-24T14:15:22Z",
  "_links": [
    { … }
  ]
}