Create encryption envelope

Starts a session for reading or changing sensitive card data: the full card number, CVC and PIN. The response contains the publicKey to encrypt your session key with and the protocol to send back unchanged.

Early access - contact your account manager to enable card issuing for your platform.

Card data is encrypted end to end. Your server calls the endpoints, while the session key is generated and used only on the cardholder's device, for example in your mobile app or web frontend. Your server passes the encrypted session key and the encrypted card data through without being able to read them, which keeps card data out of your server environment.

Call this endpoint and pass publicKey to the device.

On the device, generate a random 256-bit AES session key, encrypt it with publicKey using RSA-OAEP with SHA-256, and base64-encode the result.

Before expiresAt, call POST /baas/Cards/{id}/encrypted-details or PUT /baas/Cards/{id}/pin with protocol and the encrypted session key.

On the device, decrypt the returned values with the session key.

Errors: 404 Not Found if the card does not exist; 422 Unprocessable Content if the card is not active or frozen.

Responses

🟢200OK

application/json

Bodyapplication/json

Example

{
    "protocol": "rsa-oaep-aes-gcm-v1",
    "publicKey": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...\n-----END PUBLIC KEY-----",
    "expiresAt": "2026-09-29T10:05:00Z"
}

🟠400Bad Request

🟠404Record Not Found

🟠422Parameter Error

🔴500Server Error

Request

Request Code Samples

Responses