Skip to main content
Due to PCI DSS requirements, your company must share relevant attestation documents before Tonder activates production endpoint access. Contact your Tonder representative for compliance requirements.
The X-Skyflow-Authorization header needs to be in the following format:X-Skyflow-Authorization: <ACCESS_TOKEN_FROM_TOKENIZATION_AUTH>
Securely tokenize sensitive card data using Tonder’s vault service. This endpoint converts each card field into individual tokens that can be safely stored and used for payment processing.

​
How Tokenization Works

Tonder tokenizes each card field individually rather than creating a single token for the entire card. This means:
  • Each sensitive field (card number, CVV, expiration month, etc.) receives its own unique token
  • Tokens must be used in their corresponding fields when making payment requests
  • Tokens are not interchangeable between fields

​
Authentication Flow

Before using this endpoint, you must:
  1. Get an access token using the Get Tokenization Access Token endpoint
  2. Use the access token in the X-Skyflow-Authorization header for this request
  3. Use the tokens in payment requests via the Process Transaction endpoint

​
Security Requirements

​
PCI Compliance

Before using tokenization in production:
  • Submit PCI DSS compliance documentation
  • Complete security questionnaire
  • Undergo security review process
  • Receive production endpoint access approval

​
Best Practices

  • Use immediately: Send card data for tokenization immediately after collection
  • Don’t store raw data: Never store unencrypted card data on your servers
  • Secure transmission: Always use HTTPS for all tokenization requests
  • Token storage: Safely store the returned tokens for future payment processing

​
Field Requirements

All card fields are required for tokenization:
FieldFormatDescription
card_number13-19 digitsThe complete card number without spaces or dashes
cardholder_nameString (max 255 chars)Name as it appears on the card
cvv3-4 digitsCard security code
expiration_monthMM formatTwo-digit month (01-12)
expiration_yearYYYY formatFour-digit year

​
Response Format

The response contains individual tokens for each field: 
{
  "card_number": "9230-0892-4469-1474",        // Token for card number
  "cardholder_name": "c05d89b2-299c-4f93-b49a-42be00d3b64b", // Token for cardholder name
  "cvv": "d31f0da3-0ed3-4ad8-8b68-14c2669a99a7",             // Token for CVV
  "expiration_month": "e401a32e-4174-424f-9688-727005f6a80e", // Token for expiration month
  "expiration_year": "bd9ccc23-3d00-4109-9626-fc6581389063"  // Token for expiration year
}
Important: Each field is tokenized separately. Use each individual token in the corresponding field when making payment requests. The tokens are not interchangeable between fields.

​
Next Steps

For a complete step-by-step guide on using these tokens to process payments, see Create a Payment with Card Tokenization.