Skip to main content
The CVV Capture Form is a PCI Booking-hosted form that collects only the card security code (CVV) from the cardholder. Use it when you already have a card token but need the CVV for a transaction.

​
How It Works

  1. Your system calls the Request CVV Entry Form endpoint, passing the existing card token.
  2. PCI Booking returns a form URL that you embed as an iframe or redirect to.
  3. The cardholder enters only their CVV.
  4. PCI Booking duplicates the original card to a new token and attaches the captured CVV to the new token.
  5. The cardholder is redirected to your success URL with the new token.
The CVV capture form creates a new token with the card details copied from the original plus the captured CVV. The original token remains unchanged. It is your responsibility to delete the original token if it is no longer needed, otherwise it will continue to incur monthly storage fees.

​
Setting the CVV Retention Policy

After the new token is created with CVV, you have 60 minutes to set a CVV retention policy on it. If you don’t, your account-wide default applies. If no account default exists, the system default applies (the CVV is kept for one relay or one month, whichever comes first).

​
3D Secure

The CVV capture form supports 3DS authentication. If enabled, a 3DS challenge is presented to the cardholder after they enter their CVV. The 3D Secure session is valid for 5 minutes from the moment the card form is served. That window covers entering the card as well as completing the challenge, so a payer who takes their time on the form may find the session has already expired. When it expires, the outcome is decided by UnavailThreeDSAuth: Accept stores the card with no 3DS data, Reject sends the payer to your failure URL. In the sandbox the session does not expire, so this cannot be reproduced in testing. See 3DS Merchant Setup to configure your merchant details for the challenge screen.
If you are using 3DS authentication, you must provide either the cardholder’s email address or phone number in the request. This is required by Visa for all 3DS authentications.
You can also collect CVV remotely by sending the cardholder a link via email or SMS. See the CVV-Only Capture section in the Card By Link guide.

​
Next Steps

CVV Retention Policy

Configure how long CVV is retained.

CVV Management

Check CVV status, usage, or clear CVV on a token.

Capture Cards Overview

All tokenization methods.