Cards
Accepted brands, 3D Secure, saved cards, and what to expect from an authorization.
Accept credit and debit card payments through the unified endpoint. This guide covers card payments and handling 3D Secure when required.
Cards supports the Visa, Mastercard, American Express, and Carnet networks, available in Mexico and Chile. See Country coverage for the full breakdown by market.
Step 1: prepare the request
Create the request with the card method. Always use tokenized data when possible.
{
"operation_type": "payment",
"amount": 150.00,
"currency": "MXN",
"customer": { "name": "Ana María Rodríguez", "email": "ana.rodriguez@email.com" },
"payment_method": {
"type": "CARD",
"card_number": "9230-0892-4469-1474",
"cardholder_name": "c05d89b2-299c-4f93-b49a-42be00d3b64b",
"cvv": "d31f0da3-0ed3-4ad8-8b68-14c2669a99a7",
"expiration_month": "e401a32e-4174-424f-9688-727005f6a80e",
"expiration_year": "bd9ccc23-3d00-4109-9626-fc6581389063"
},
"client_reference": "ORD-001",
"return_url": "https://yourstore.com/payment/return"
}Always include a return_url when processing cards: it's required for 3D Secure authentication flows.
Step 2: handle the response
Without 3DS, the payment is processed immediately (authorized). If additional authentication is
required, the response includes redirect information.
{
"id": "550e8400-e29b-41d4-a716-446655440000",
"operation_type": "payment",
"status": "authorized",
"amount": 150.00,
"currency": "MXN",
"payment_id": 12345,
"transaction_id": "txn_abc123",
"created_at": "2024-07-26T10:30:00Z"
}{
"id": "550e8400-e29b-41d4-a716-446655440000",
"status": "pending",
"next_action": {
"redirect_to_url": {
"url": "https://secure.payment-provider.com/3ds/abc123",
"return_url": "https://yourstore.com/payment/return"
}
}
}Step 3: handle 3D Secure
Use the URL from next_action.redirect_to_url.url.
They complete the 3D Secure challenge on their bank's page.
After authenticating, they return to your return_url.
Make a GET /api/v1/transactions/{id}/ to confirm the result.
curl -X GET https://stage.tonder.io/api/v1/transactions/550e8400-e29b-41d4-a716-446655440000/ \
-H "Authorization: Token YOUR_API_KEY"Tokenized vs. raw data
For most merchants, the tokenized flow (3 steps: get token → tokenize → process) reduces your PCI scope. Raw card data processing requires PCI DSS Level 1 certification.