Create Card

Card issuance sequence:

Onboard Customer: Create the cardholder as a customer resource, if they don't already exist.
Identity Verification: Trigger KYC/KYB for the customer. This is required before a card can be issued.
Create the card: Call the create card endpoint, referencing the product and (where required) the customer and account.
Listen to the card.created webhook event to know when the card is ready.
Fetch the card and show non-sensitive details (masked PAN, last 4, status) by default.
Use the reveal-token flow to securely retrieve the full PAN/CVV, only when the cardholder needs it.

1. Onboard Customer:

Start by onboarding the customer the card will belong to. Refer to our guides for individual and business customer onboarding respectively.

2. Identity Verification:

KYC (for individual customers) or KYB (for business customers) must be completed before a card can be created for the customer. See Individual Customer KYC and Business Customer KYB for details.

3. Create Card

Once the customer is verified from the steps above, call the endpoint below to create a card.

Method	Endpoint
`POST`	`/api/v1/cards`

{
  "data": {
    "type": "Card",
    "attributes": {
      "description": "Operations expense card",
      "productName": "VIRTUAL_PREPAID_TEST"
    },
    "relationships": {
      "customer": {
        "data": {
          "id": "customer_123",
          "type": "IndividualCustomer"
        }
      },
      "account": {
        "data": {
          "id": "account_123",
          "type": "DepositAccount"
        }
      }
    }
  }
}

{
    "data": {
        "id": "17854989961461-anc_card",
        "type": "Card",
        "attributes": {
            "createdAt": "2026-07-31T11:56:36.382655507",
            "balance": {
                "pending": 0,
                "available": 0,
                "hold": 0,
                "ledger": 0
            },
            "description": "Marketing Spend",
            "currency": "USD",
            "billingAddress": {
                "line1": "256 Chapman road Newark STE Delaware United States",
                "line2": "256 Chapman road Newark STE Delaware United States",
                "city": "Newark",
                "state": "Delaware",
                "postalCode": "19702",
                "country": "US"
            },
            "productName": "VIRTUAL_PREPAID_TEST",
            "status": "PENDING",
            "updatedAt": "2026-07-31T11:56:36.382655507"
        },
        "relationships": {
            "product": {
                "data": {
                    "id": "1781607739042637563310944166442-anc_prd",
                    "type": "Product"
                }
            },
            "organization": {
                "data": {
                    "id": "17854968935591-anc_og",
                    "type": "Organization"
                }
            },
            "account": {
                "data": {
                    "id": "1785497195556108-anc_acc",
                    "type": "DepositAccount"
                }
            },
            "customer": {
                "data": {
                    "id": "1785498903074133-anc_ind_cst",
                    "type": "IndividualCustomer"
                }
            }
        }
    }
}

Field	Description
`description`	Required label for the card.
`productName`	Required name of an enabled card product. Replace the example with your configured product.
`customer`	Required relationship to the cardholder. Use the customer's actual resource type.
`account`	Optional relationship. This is based on your card product configuration

A successful request returns 201 Created with a card in PENDING status:

Save the card ID to associate the card with your application's records. A successful creation request does not mean issuance has finished.

4. Confirm the card is ready

Card creation is asynchronous. The initial response has status PENDING; wait for card.created before treating issuance as complete. Enable Support Included to use the card details supplied with that notification. See Card Events for subscription and payload guidance.

Once the card is ACTIVE, display its non-sensitive details, such as its description and last four digits.

5. Retrieving Sensitive Card Details

Retrieving a card’s PAN, PIN, CVV, and expiry information is a secure two-step process:

Generate a short-lived reveal token.
Use the reveal token to retrieve the sensitive card details.

The reveal token is valid for a limited period and must only be used for the card for which it was generated.

Step 1: Generate a reveal token

Request a temporary reveal token for the card. A successful request returns 201 Created with these token fields:

Method	Endpoint
`POST`	`/api/v1/cards/:cardID/reveal-token`

curl --location --request POST 'https://api.getanchor.co/api/v1/cards/17840266131572-anc_card/reveal-token' \
--header 'x-anchor-key: <API Key>'

{
    "data": {
        "token": "eyJvcmdhbml6YXRpb25JZCI6IjE2NTM0OTMxNTcyLWFuY19jYXJkVhbIjoxNzgQ.6CX9xVa-",
        "expiresAt": "2026-07-20T16:53:31.356886550Z",
        "expiresInSeconds": 300
    }
}

Field	Description
`token`	Short-lived JWT used to authorize the sensitive-details request.
`expiresAt`	Exact date and time at which the reveal token expires.
`expiresInSeconds`	Remaining token validity in seconds. In this example, the token is valid for five minutes.

Step 2: Retrieve the sensitive card details

The token identifies the card, so this route does not take a card ID. A successful response returns 200 OK with the sensitive card-details representation for your configured reveal integration.

Method	Endpoint
`GET`	`/api/v1/cards/details`

curl --location 'https://apiv2.getanchor.co/api/v1/cards/details' \
--header 'Authorization: Bearer <token>>' \

{
    "data": {
        "id": "178401572-anc_card",
        "type": "CardDetails",
        "attributes": {
            "cvv": "123",
            "expiryMonth": "07",
            "expiryYear": "2030",
            "pan": "5399830000000234",
            "pin": "1232"
        },
        "relationships": {
            "card": {
                "data": {
                    "id": "178401572-anc_card",
                    "type": "Card"
                }
            }
        }
    }
}

Token handling requirements:

Generate a new reveal token whenever the cardholder requests sensitive details.
Use the token only for the card identified by :cardID .
Do not persist the reveal token in a database, browser storage, analytics system, or application logs.
Do not place the token in a URL or query parameter.
Do not send the user’s regular access token to the details endpoint in place of the reveal token.
Discard the token immediately after the details request.
If the token expires, generate a new token instead of retrying with the expired token.
Do not automatically generate another token without confirming that the user’s session remains authorized.