Tokens

Tokenization is the process Axxonpay uses to collect sensitive card or bank account details, or personally identifiable information (PII), directly from your customers in a secure manner. A token representing this information is returned to your server to use.

Client-Side Tokenization

We recommend using our recommended payments integrations to perform the tokenization process client-side. This ensures that no sensitive card data touches your server and allows your integration to operate in a PCI-compliant way. By using client-side tokenization, you benefit from the following:

• Secure collection of sensitive information
• PCI compliance
• Seamless integration with Axxonpay's recommended payment flows

 const crypto = require('crypto');
const axios = require('axios');
 
// Define the request body
const dataObj = {
  amount: 10000,
  currency: 'USD',
  cardNumber: 4242424242424242,
  expMonth: '12',
  expYear: '2029',
  cvc: '984',
  description: 'Payment for Service',
  customer_id: '<example client Id>',
  name: 'John Smith',
  email: 'johnsmith@gmail.com',
  return_url: 'https://google.com',
  remote_ip: '192.76.99.255',
  postal_code: '94102',
  line1: '986 Holloway Street',
  line2: 'APT 781',
  city: 'Los Angeles',
  state: 'CA',
  country: 'US',
};
 
const key = crypto.pbkdf2Sync('key_<Your-Key>', 'sig_<Your-Signature>', 1000, 32, 'sha256');
 
function tokenizeObject(objectData, encryptionKey) {
  // Convert the object to a JSON string
  const jsonString = JSON.stringify(objectData);
  // Generate a random initialization vector (IV)
  const iv = crypto.randomBytes(16); // Updated to 16 bytes (128 bits)
  // Create a cipher using the encryption key and IV
  const cipher = crypto.createCipheriv('aes-256-cbc', encryptionKey, iv);
  // Encrypt the JSON string
  let encryptedData = cipher.update(jsonString, 'utf8', 'hex');
  encryptedData += cipher.final('hex');
  // Generate a token by combining the IV and encrypted data
  const token = iv.toString('hex') + encryptedData;
  return token;
}
 
const tokenized = tokenizeObject(dataObj, key);
 
// Define the headers with the signature
const headers = {
  signature: 'sig_<Your-Signature>',
  authorization: 'key_<Your-Key>',
};
 
const data = {
  // Add your request body data here
  token: tokenized,
};
 
// Make the POST request
axios.post('/v1/process/card-payment', data, { headers })
  .then((response) => {
    console.log(response.data);
  })
  .catch((error) => {
    console.error(error);
  });
 

API Tokenization

If client-side tokenization is not feasible for your integration, you can create tokens using the Axxonpay API with either your publishable or secret API key. However, please note the following:

• When using API tokenization, you are responsible for any PCI compliance requirements.
• You must keep your secret API key safe.
• Unlike client-side tokenization, the customer's information is not sent directly to Axxonpay, so we cannot determine how it is handled or stored.

Card Tokenization Endpoint

  POST /v1/create/token

Sepa Debit Tokenization Endpoint

  POST /v1/create/sepa/token

Token Usage

Tokens cannot be stored or used more than once. If you need to store card or bank account information for later use, you can create Customer objects or Custom accounts. It's important to note that Axxonpay Radar, our integrated solution for automatic fraud protection, performs best with integrations that use client-side tokenization.

For detailed information on creating tokens using the API, refer to the following endpoint:

POST /v1/tokens

Create a new token with the specified data.

Card Tokenization Endpoint

  POST /v1/create/token

Sepa Debit Tokenization Endpoint

  POST /v1/create/sepa/token

GET /v1/tokens/:id

Retrieve a specific token by its ID.

  GET /v1/retrieve/token/:id

Card Tokenization

  POST /v1/create/token

Sepa Debit Tokenization

  POST /v1/create/sepa/token