Card Payment Guide
Build a card payment step by step, tokenized or with raw card data.
Pick the flow that matches your integration and build the request live. Most businesses use tokenized card.
🇲🇽 🇨🇱 Mexico and Chile use exactly the same flow. The endpoints, the headers and the way you
tokenize don't change. The only difference is currency: "MXN" for Mexico, "CLP" for Chile.
You'll turn the real card data into random codes called tokens, so you never store or send the real number from your server. Tonder tokenizes each field separately: you get 5 distinct tokens, one per field — not a single token for the whole card.
Before tokenizing, Tonder needs to confirm it's you. Your API key buys a short-lived permission — a JWT — so it can't be reused indefinitely if it ever leaks.
curl -X GET "https://stage.tonder.io/api/v1/tokenization/auth/" \
-H "Authorization: Token YOUR_TONDER_API_KEY"The response carries the JWT you'll use in step 2:
{ "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." }You send the real data to the tokenization service, authorized with the access_token from step 1
(X-Skyflow-Authorization header). It returns a random code per field; that code means nothing on
its own — only Tonder can translate it back when processing the payment.
The route_id differs per environment. The service lives on its own domain
(token-sandbox.tonder.io / token.tonder.io), not under Tonder's /api/v1/.
curl -X POST "https://token-sandbox.tonder.io/v1/gateway/inboundRoutes/YOUR_ROUTE_ID/token" \
-H "Authorization: Token YOUR_TONDER_API_KEY" \
-H "X-Skyflow-Authorization: YOUR_ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"card_number": "4000000000000077",
"cardholder_name": "Ozzy Osbourne",
"cvv": "123",
"expiration_month": "07",
"expiration_year": "26"
}'The service responds with one token per field. They are not interchangeable between fields.
Build the payment like any other, but use the step-2 tokens instead of the real number. Tonder detokenizes them server-side to charge the real card.
curl -X POST "https://stage.tonder.io/api/v1/process/" \
-H "Authorization: Token YOUR_TONDER_API_KEY" \
-H "X-Request-Id: 550e8400-e29b-41d4-a716-446655440000" \
-H "Content-Type: application/json" \
-d '{
"operation_type": "payment",
"amount": 150.00,
"currency": "MXN",
"customer": {
"name": "Ozzy Osbourne",
"email": "ozzy@testuser.com"
},
"payment_method": {
"type": "CARD",
"card_number": "9230-0892-4469-1474",
"cardholder_name": "c05d89b2-299c-4f93-b49a-42be00d3b64b",
"cvv": "d31f0da3-0ed3-4ad8-8b68-14c2669a99a7",
"expiration_month": "e401a32e-4174-424f-9688-727005f6a80e",
"expiration_year": "bd9ccc23-3d00-4109-9626-fc6581389063"
},
"client_reference": "ORD-001",
"return_url": "https://tonder.io"
}'Always validate both id (store it) and status. Never rely on the HTTP code alone — verify the
final status at GET /api/v1/transactions/{id}/.