1 endpoint
Card API
Tokenized card payments: the card is charged from its identifier, and the cardholder re-enters the CVV for every payment.
Endpoint names and descriptions come from the OpenAPI contract, in English — they cannot drift from the API.
You create your test key in the portal as soon as your account is activated.
In plain English
Your customer pays again with the card they already used with you, re-entering only the security code.
When to use it
When your customer has already paid once by card and comes back to pay in session: they no longer type their card number, only their CVV. The card API is enabled account by account, on request.
How to integrate it
- 1Keep the tokenizedCardId returned by the payment that tokenized the card — never the card number or the CVV.
- 2On the next payment, ask the cardholder for their CVV, then call the route with the cardId and the CVV.
- 3If redirect is true, send the cardholder to redirectionUrl to complete 3-D Secure.
- 4Read data.status for the outcome, and keep operationId for a capture, a void or a refund.
Pay with a tokenized card (CVV re-entered)
Charges a card tokenized during an earlier card payment, without resending the card number or expiry date. The CVV is not part of the token: the cardholder re-enters it for each payment on this route, and the request is refused without it. cardId is the tokenizedCardId returned by the payment that tokenized the card. 3-D Secure is on and capture is automatic by default; set autoCapture to false to authorize only. When redirect is true, send the cardholder to redirectionUrl to complete 3-D Secure. Requires the card API to be enabled for your account, otherwise 403 CARD_API_NOT_ENABLED. Responses use the envelope {status, message, data}.
Schema · TokenizedCardPaymentRequest
| Field | Type | In | Required | Description |
|---|---|---|---|---|
cardId | integer (int32) | path | Required | Identifier of the tokenized card: the tokenizedCardId returned by the payment that tokenized it. |
phoneNumber | string | query | Optional | Optional. In sandbox the shared test wallet always collects. In production your merchant wallet collects, and any other number is refused (403 PHONE_NUMBER_NOT_OWNED). |
cvv | string | body | Required | Card security code, 3 or 4 digits, re-entered by the cardholder for this payment. Never store it. |
amount | number | body | Required | Amount to charge, in MAD, strictly positive. |
threeDSecure | boolean | body | Optional | 3-D Secure authentication. Defaults to true. |
autoCapture | boolean | body | Optional | Capture automatically. Defaults to true; false authorizes the funds only. |
acceptUrl | string | body | Optional | Where the cardholder returns after a successful 3-D Secure step. |
declineUrl | string | body | Optional | Where the cardholder returns after a failed 3-D Secure step. |
notificationUrl | string | body | Optional | Your server URL, stored on the operation. |
externalReference | string | body | Optional | Your own reference, such as the order number. |
Make your first test-mode call
Create your account, generate your test key in the portal and send your first request today — or talk to an integrator.
- Free, no commitment
- Test mode from sign-up
- No approval to wait for