Request a Card Security Code Entry Form

const params = new URLSearchParams({
  accessToken: 'your-access-token',
  brand: 'your-username',
  cardUri: 'https://service.pcibooking.net/api/payments/paycard/865ed8bec1f84366b97112a69cdbf915',
  language: 'en',
  success: 'https://example.com/success',
  failure: 'https://example.com/failure'
});

const formUrl = `https://service.pcibooking.net/api/payments/cvvcapturecard?${params}`;

// Use it as the iframe source
document.getElementById('cvv-form').src = formUrl;

<iframe id="cvv-form"
        src="https://service.pcibooking.net/api/payments/cvvcapturecard?accessToken=your-access-token&brand=your-username&cardUri=https%3A%2F%2Fservice.pcibooking.net%2Fapi%2Fpayments%2Fpaycard%2F865ed8bec1f84366b97112a69cdbf915&language=en&success=https%3A%2F%2Fexample.com%2Fsuccess&failure=https%3A%2F%2Fexample.com%2Ffailure">
</iframe>

<!-- The hosted CVV capture form, rendered by the browser -->

GET

api

payments

cvvcapturecard

const params = new URLSearchParams({
  accessToken: 'your-access-token',
  brand: 'your-username',
  cardUri: 'https://service.pcibooking.net/api/payments/paycard/865ed8bec1f84366b97112a69cdbf915',
  language: 'en',
  success: 'https://example.com/success',
  failure: 'https://example.com/failure'
});

const formUrl = `https://service.pcibooking.net/api/payments/cvvcapturecard?${params}`;

// Use it as the iframe source
document.getElementById('cvv-form').src = formUrl;

<iframe id="cvv-form"
        src="https://service.pcibooking.net/api/payments/cvvcapturecard?accessToken=your-access-token&brand=your-username&cardUri=https%3A%2F%2Fservice.pcibooking.net%2Fapi%2Fpayments%2Fpaycard%2F865ed8bec1f84366b97112a69cdbf915&language=en&success=https%3A%2F%2Fexample.com%2Fsuccess&failure=https%3A%2F%2Fexample.com%2Ffailure">
</iframe>

<!-- The hosted CVV capture form, rendered by the browser -->

CVV Capture Guide

Collect CVV from cardholders via hosted forms

This is not an API call you make from your server: you build the URL with the query parameters below and use it as the src of an iframe element on your page, or redirect the cardholder’s browser to it. The browser then loads the hosted CVV capture form directly from PCI Booking. For the element IDs and classes you can target with custom CSS, see the form structure reference.

Submitting this form creates a new token that is a full copy of the original card details plus the captured CVV. The original token is not modified and does not contain the CVV. You are responsible for deleting the original token if it is no longer needed, otherwise it will continue to incur monthly storage fees. Remember to set the CVV Retention Policy on the new token.

Parameters

Authentication

This is a browser-facing endpoint. Use one of the authentication methods below instead of the API key shown above.

string

Recommended. A long-lived token for browser-side calls. How to generate.

string

Alternative. Valid for 5 minutes. How to generate.

If both are provided, the session token takes precedence.

Form Configuration

All URLs passed as query parameters (cardUri, success, failure) must be https and must be URL-encoded.

string

required

Your PCI Booking username, used to identify your account.

string

required

The resource identifier (URI) for the card location within PCI Booking.

string

required

The form’s language in ISO 639-1 (2-letter) format - see here. If an unsupported language is provided, English will be displayed. To add languages, contact support.

string

The CSS resource name. See the guide on managing stylesheets. If omitted, the default CSS is applied.

boolean

default:"false"

Whether to remove the PCI Booking base CSS. The base CSS does not collide with the host site’s CSS. true: remove base CSS. false: use base CSS.

string

URL to redirect to on successful submission. See success/failure redirection pages.

string

URL to redirect to on failed submission. See success/failure redirection pages.

boolean

Whether to exclude the PCI Booking submit button, allowing the host site to use its own button. true: exclude submit button. false: include submit button. See postMessage integration.

boolean

default:"true"

Whether the card security code field receives focus when the parent page loads.

string

The origin URL of the host page where the iframe is displayed, URL-encoded (e.g. https%3A%2F%2Fwww.yoursite.com). Required for postMessage communication between the form and your page.

string

A reference value that can be used to query for this card token later.

3D Secure

Visa requirement (Aug 2024): You must provide at least the cardholder’s email or phone for 3DS authentication.

boolean

default:"false"

Whether to perform 3D Secure authentication after card entry. If enabled with Access Token authorization, provide two access tokens.

string

default:"Accept"

Action to take if a technical problem occurs during 3DS processing. Accept: ignore 3DS failure and proceed with tokenization. Reject: do not tokenize the card; redirect to the failure URL.

The default, Accept, means that if 3DS can’t complete, the card is still tokenized without 3DS data. If you later charge that token through a PSP that requires 3DS, the charge will be rejected. Set this to Reject if every token in your flow must have 3DS data.

string

The merchant name for 3D Secure authentication. Must be URL-encoded and unique per 3DS merchant account. See 3DS merchant setup.

integer

default:"0"

Transaction amount for the 3D Secure challenge screen. Must be provided together with currencyCode. If omitted, authentication uses a 0 EUR amount.

string

default:"EUR"

Currency code for the 3D Secure challenge screen amount. Must be provided together with amount. If omitted, authentication uses a 0 EUR amount.

string

Cardholder’s email address for 3D Secure authentication. Must be a valid email format, e.g. joe@bloggs.com.

string

Cardholder’s telephone number for 3D Secure authentication. May only contain digits [0-9], e.g. 00353112223344.

const params = new URLSearchParams({
  accessToken: 'your-access-token',
  brand: 'your-username',
  cardUri: 'https://service.pcibooking.net/api/payments/paycard/865ed8bec1f84366b97112a69cdbf915',
  language: 'en',
  success: 'https://example.com/success',
  failure: 'https://example.com/failure'
});

const formUrl = `https://service.pcibooking.net/api/payments/cvvcapturecard?${params}`;

// Use it as the iframe source
document.getElementById('cvv-form').src = formUrl;

<iframe id="cvv-form"
        src="https://service.pcibooking.net/api/payments/cvvcapturecard?accessToken=your-access-token&brand=your-username&cardUri=https%3A%2F%2Fservice.pcibooking.net%2Fapi%2Fpayments%2Fpaycard%2F865ed8bec1f84366b97112a69cdbf915&language=en&success=https%3A%2F%2Fexample.com%2Fsuccess&failure=https%3A%2F%2Fexample.com%2Ffailure">
</iframe>

Response

200 - The browser renders the hosted CVV capture form.

<!-- The hosted CVV capture form, rendered by the browser -->

Start Here

Authentication & General

Capture Cards

Manage Tokens

Use Tokens

Additional Functions

Payments Library

Request a Card Security Code Entry Form

CVV Capture Guide

Parameters

Authentication

Form Configuration

3D Secure

Response

CVV Capture Guide

​Parameters

​Authentication

​Form Configuration

​3D Secure

​Response

Parameters

Authentication

Form Configuration

3D Secure

Response