Create card embed session

post

https://sandbox.lithic.com/v1/cards/{card_token}/embed

Creates a short-lived session for displaying card details or setting a card PIN in
Lithic-hosted iframes. Create the session on your backend to not expose your API key in browser code.

A session token can only be used to reveal card details (per embed type) or submit a pin a single time. Attempting to
re-use session tokens will result in 401's.

Path Params

card_token

uuid

required

Body Params

Card embed session parameters.

Parameters for creating a short-lived card embed session.

type

string

enum

required

The type of card embed session to create.

CARD_EMBED sessions can load PAN, CVV, EXP_MONTH, and EXP_YEAR iframes.

PIN_SETTING_EMBED sessions can load only the PIN_SETTING iframe.

Allowed:

expiration

int64

Unix timestamp at which the session expires. The value must be in the future and no more than
10 minutes after the request. If omitted, the session expires 10 minutes after the request.

target_origin

uri

required

Canonical HTTPS origin of the page that will embed the iframe. Lithic embeds will verify the target_origin against the parent application's origin.
The origin must not contain a path, query parameters, fragment, or credentials.

Responses


User has not been authenticated	Invalid or missing API key
API key is not active	The API key used is no longer active
Could not find API key	The API key provided is not associated with any user
Please provide API key in Authorization header	The Authorization header is not in the request
Please provide API key in the form Authorization: [api-key]	The Authorization header is not formatted properly
Insufficient privileges. Issuing API key required	Write access requires an Issuing API key. Reach out at lithic.com/contact
Insufficient privileges to create virtual cards.	Creating virtual cards requires an additional privilege


Rate limited, too many requests per second	User has exceeded their per second rate limit
Rate limited, reached daily limit	User has exceeded their daily rate limit
Rate limited, too many keys tried	One IP has queried too many different API keys

Language

Credentials

Header

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

200A short-lived card embed session.

400A parameter in the query given in the request does not match the valid queries for the endpoint.

404The specified resource was not found.

422Unprocessable entity.