Create token

curl -X POST "https://test-fep.kashier.io/v3/cards/tokens" \  -H "Kashier-Hash: string" \  -H "Content-Type: application/json" \  -d '{    "merchantId": "YOUR_MID",    "customerReference": "CUST-001",    "paymentMethod": {      "type": "CARD",      "card": {        "number": "5123456789012346",        "expiry": {          "month": "12",          "year": "25"        },        "nameOnCard": "John Doe",        "securityCode": "123"      }    },    "customer": {      "reference": "CUST-001"    }  }'

{  "status": "SUCCESS",  "messages": {    "en": "Card is tokenized successfully",    "ar": "Card is tokenized successfully"  },  "response": {    "paymentMethod": {      "type": "CARD",      "card": {        "number": "512345********2346",        "cardToken": "7a5e3c72-61d9-4ebf-88b9-27dc0f77b638",        "cardDataToken": "7a5e3c72-61d9-4ebf-88b9-27dc0f77b638",        "cvvToken": "9d8332cb-6195-40ea-aed0-86c3aa60fbaa",        "agreement": {          "type": "perm",          "id": "886f122a-2d9e-4a35-8be8-79fdd88b9ffd"        }      }    }  }}

Saves a card and returns a reusable cardToken you can charge later with Pay with token. Send the raw card details once; Kashier stores them and hands back only the token and a masked card number, so your systems never have to keep the PAN. The request is validated with a Kashier-Hash header — an HMAC SHA256 hash of the path /?tokenization={merchantId}.{customerReference} generated from your backend with your secret. Use only those parameters in the hash creation; don't add extra parameters. The securityCode (CVV) you submit is exchanged for a single-use cvvToken; a stored token cannot be reused as a CVV on a later payment.

Header Parameters

Response Body