Retrieve tokens

A GET request is made to the "get customer card token and info" endpoint.

Hashing

Token requests are validated with a Kashier-Hash header: an HMAC SHA256 of the tokenization path, keyed with your Payment API Key. Generate it in your backend.

Key the hash with the Payment API Key, not the Secret Key

The Secret Key goes in the Authorization header; the Payment API Key keys the hash. Swapping them is the usual cause of 400 invalid authorization on this endpoint. Both are mode-scoped — a test key only validates on the test- hosts.

//Copy and paste this code in your Backend
let crypto = require('crypto');
function generateKashierTokenHash() {
    const mid = 'MID-123-123'; //your merchant id
    const CustomerReference = '1'; //your customer id the card was saved against
    const apiKey = 'yourPaymentApiKey';
    const path = `/?tokenization=${mid}.${CustomerReference}`;
    return crypto.createHmac('sha256', apiKey).update(path).digest('hex');
}

//Copy and paste this code in your Backend
function generateKashierTokenHash(){
    $mid = "MID-123-123"; //your merchant id
    $apiKey = "yourPaymentApiKey";
    $CustomerReference = "100"; //your customer id the card was saved against
    $path = "/?tokenization=".$mid.".".$CustomerReference;
    return hash_hmac('sha256', $path, $apiKey, false);
}

#Copy and paste this code in your Backend
import hmac
import hashlib
def generate_kashier_token_hash():
    mid = "MID-123-123"  # your merchant id
    CustomerReference = "100"  # your customer id the card was saved against
    path = '/?tokenization={}.{}'.format(mid, CustomerReference).encode('utf-8')
    api_key = "yourPaymentApiKey".encode('utf-8')
    return hmac.new(api_key, path, hashlib.sha256).hexdigest()

//Copy and paste this code in your Backend
using System.Security.Cryptography;
public class Kashier
{
    public static string create_hash(){
        string mid = "MID-123-123"; //your merchant id
        string CustomerReference = "1"; //your customer Id
        string secret = "yourPaymentApiKey";
        string path = "/?tokenization=" + mid + "." + CustomerReference;
        string message;
        string key;
        key = secret;
        message = path;
        System.Text.ASCIIEncoding encoding = new System.Text.ASCIIEncoding();
        byte[] keyByte = encoding.GetBytes(key);
        byte[] messageBytes = encoding.GetBytes(message);
        HMACSHA256 hmacmd256 = new HMACSHA256(keyByte);
        byte[] hashmessage = hmacmd256.ComputeHash(messageBytes);
        return ByteToString(hashmessage).ToLower();
    }
    public static string ByteToString(byte[] buff){
        string sbinary = "";
        for (int i = 0; i < buff.Length; i++){
            sbinary += buff[i].ToString("X2"); // hex format
        }
        return (sbinary);
    }
}

Note

For creating the hash, use only the parameters mentioned in the snippet above. Don't add extra parameters in the hash creation.

In case you are still in the development phase, you will need to call our API using the following testing endpoint API URL.

Endpoint	Value
TEST-URL	`https://test-fep.kashier.io/v3/cards/customer?customerReference=yourcustomerReference&merchantId=merchantId`
LIVE-URL	`https://fep.kashier.io/v3/cards/customer?customerReference=yourcustomerReference&merchantId=merchantId`
Method	GET

Headers

Key	Description
Authorization	Your Secret Key.
Kashier-Hash (String)	HMAC SHA256 of `/?tokenization={mid}.{customerReference}`, keyed with your Payment API Key — see Hashing above.

curl -X 'GET' 'https://test-fep.kashier.io/v3/cards/customer?customerReference=yourcustomerReference&merchantId=merchantId' \
  -H 'Authorization: your_secretKey' \
  -H 'Kashier-Hash: your_generated_hash' \
  -H 'accept: application/json'

A customer with no saved card returns 400 with There are no cards with this token — that is an empty result, not an authentication failure.

Full parameter and response reference → Retrieve tokens.

Retrieve tokens

Hashing

Retrieve tokens

Headers

On this page