Hosted Card Entry Form

The Hosted Card Entry Form is a PCI Booking-hosted page where cardholders enter their card details securely. You embed it as an iframe or redirect to it as a standalone page. Card data never touches your servers.

This is a non-functional preview showing the default card entry form. The form’s appearance can be fully customized with your own CSS stylesheet.

There are two ways to create a card entry form: URL with query parameters or API session. Both produce the same form. The difference is how you configure it and how you receive the result.

Option 1: URL with Query Parameters

Build the form URL directly by appending configuration as query parameters. This is the simpler approach and requires no server-side API call to set up the form.

https://service.pcibooking.net/api/payments/capturecard?sessionToken=YOUR_SESSION_TOKEN&brand=YOUR_USERNAME&language=en&postMessageHost=https%3A%2F%2Fyoursite.com&autoDetectCardType=true&success=https://yoursite.com/success&failure=https://yoursite.com/failure

Embed it in your page:

<iframe
  src="https://service.pcibooking.net/api/payments/capturecard?sessionToken=YOUR_SESSION_TOKEN&brand=YOUR_USERNAME&language=en&autoDetectCardType=true&success=https://yoursite.com/success&failure=https://yoursite.com/failure"
  width="400"
  height="350"
  frameborder="0">
</iframe>

When the cardholder submits the form, PCI Booking redirects to your success URL with the token appended. You can also specify a failure URL for declined or cancelled submissions. See the full parameter reference for all available query parameters.

Option 2: API Session

Create a card entry form session via a server-side API call. Configuration is set in the request body rather than in the URL, so nothing is exposed to the client. Results are delivered via a server-to-server callback.

Set up a callback endpoint

Create an endpoint on your server to receive tokenization results from PCI Booking. This is a one-time setup. See the callback reference for the payload format.

Create a card entry form session

Send a POST request to create the session:

curl -X POST https://service.pcibooking.net/api/capturecard \
  -H "Authorization: APIKEY your-api-key" \
  -H "Content-Type: application/json" \
  -d '{
    "TTL": 120,
    "CallBackURL": "https://your-server.com/card-captured",
    "Properties": {
      "CardCaptureType": "Tokenize",
      "Language": "en",
      "ShowCVV": true,
      "AutoDetectCardType": true
    }
  }'

The response returns a RequestID and a Location header containing the form URL.

Embed the form

Take the URL from the Location header and set it as the iframe source in your page:

<iframe src="{{Location-header-URL}}" width="400" height="300" frameborder="0"></iframe>

Receive the callback

When the cardholder submits the form, PCI Booking sends a POST to your CallBackURL with the token details. You can also poll the session status using the request ID:

curl -X GET https://service.pcibooking.net/api/capturecard/{requestId} \
  -H "Authorization: APIKEY your-api-key"

Clean up (optional)

Delete the session if the cardholder abandons the form or you no longer need it.

Which Should I Use?

	URL with Query Parameters	API Session
Setup	No server-side call needed. Build the URL directly.	Requires a server-side API call to create the session.
Configuration	Query parameters in the URL.	JSON body in the API request.
Result delivery	Redirect to success/failure URLs.	Callback POST to your server, plus session polling.
Session tracking	No built-in tracking.	Request ID for status queries.
TTL control	No configurable TTL.	Set session expiry via `TTL` parameter.
Security	Parameters are visible in the iframe URL and could be manipulated on the client side.	Parameters are set server-side. The generated short URL contains no configuration, so there is nothing for an attacker to manipulate via site injection.

For quick integrations and prototyping, the URL approach is fastest. For production use, the API session provides better security, callback support, and session management.

Key Features

Both approaches support:

CSS customization. Style the form to match your brand by storing a stylesheet. See the Stylesheets guide for details.
3D Secure. Add ThreeDS=true to the request and PCI Booking runs the 3DS challenge automatically inside the iframe if required by the issuing bank - no other setup needed on your side beyond configuring your 3DS merchant details. The cardholder has 5 minutes to complete the challenge before it expires. Note: if 3DS can’t complete, UnavailThreeDSAuth defaults to Accept, which tokenizes the card anyway without 3DS data - see Request Card Entry Form if you need every token to have 3DS data.
Multi-language. Set the form language via the Language parameter (ISO 639-1 two-letter code).

When embedding in an iframe, ensure your Content Security Policy allows framing from service.pcibooking.net.

Next Steps

Card Validation Errors

Error messages the cardholder may see when entering invalid card data.

Stylesheets Guide

Customize the look and feel of your card entry form.

Capture Cards Overview

All available tokenization methods.

Start Here

Getting Started

Concepts

Guides

Capture Cards

Payments Library

Manage Tokens

Use Tokens

Account Configuration

Additional Functions

Reference

Support

Hosted Card Entry Form

Option 1: URL with Query Parameters

Option 2: API Session

Which Should I Use?

Key Features

Next Steps

Card Validation Errors

Stylesheets Guide

Capture Cards Overview

​Option 1: URL with Query Parameters

​Option 2: API Session

​Which Should I Use?

​Key Features

​Next Steps

Card Validation Errors

Stylesheets Guide

Capture Cards Overview

Option 1: URL with Query Parameters

Option 2: API Session

Which Should I Use?

Key Features

Next Steps