Capture Cards Overview

Tokenization is how card data enters PCI Booking. The method you use depends on where the card data comes from.

Collecting Cards from the Cardholder

Use these methods when the cardholder enters their own card details. All three support 3D Secure natively in the UI with no additional development on your side.

Method	How It Works
Card Entry Form	PCI Booking hosts a secure form that you embed via iframe or redirect. The cardholder enters their card and PCI Booking tokenizes it on submission. The simplest integration for web-based card capture.
Card By Link	Send a secure link to the cardholder via email or SMS. The cardholder clicks the link, enters their card on a hosted page, and PCI Booking tokenizes it. Ideal for call centers, remote collection, and any scenario where the cardholder is not on your website.
Payments Library	Client-side JavaScript library (`@pcibooking/ewallet`) that renders a card form in your checkout page. Also supports alternative payment methods (Apple Pay, Google Pay, PayPal). The richest feature set for web and mobile checkout flows.

Receiving Cards from a Third Party via HTTP

Use these methods when card data flows through HTTP requests or responses between your system and a third party.

Method	How It Works
Tokenization on Response	Route your outbound HTTP requests through PCI Booking as a proxy. When the third party responds with card data, PCI Booking parses the response using a profile you define (or a universal profile for common third parties), tokenizes all card details, and forwards a sanitized response to you. Card data never reaches your systems.
Tokenization on Request (Gateway)	The reverse direction. When a third party sends card data to your API, PCI Booking sits as a gateway in front of your endpoint, tokenizes the card details in the inbound request, and forwards a sanitized version to you.

Receiving Cards from a Third Party via File

Method	How It Works
File Transfer (SFTP/FTPS)	PCI Booking acts as a secure file transfer proxy. You call the API with the third party’s SFTP or FTPS server details, and PCI Booking downloads the file, tokenizes all card numbers it finds, and returns the tokenized content to you. Card data never touches your systems.

Direct API (Card Migration)

Method	How It Works
Store Card API	POST card data directly to the PCI Booking API. Use this for migrating cards from another vault, provider, or internal storage. If your systems handle raw card data during the migration, you may be in PCI DSS scope for that period. Make sure to clear all card records from your systems once the migration is complete.

What Happens When a Card Is Tokenized

Regardless of the method, the outcome is the same:

Card data is captured through one of the methods above.
PCI Booking encrypts and stores the card in our PCI DSS Level 1 vault.
A token is returned to your system.
You use the token for all subsequent operations: manage, query, or detokenize.

Next Steps

Manage Tokens

Query, update, and manage your stored tokens

Use Tokens

Send card data to PSPs, partners, or display it

Start Here

Getting Started

Guides

Concepts

Capture Cards

Payments Library

Manage Tokens

Use Tokens

Account Configuration

Additional Functions

Reference

Support

Capture Cards Overview

Collecting Cards from the Cardholder

Receiving Cards from a Third Party via HTTP

Receiving Cards from a Third Party via File

Direct API (Card Migration)

What Happens When a Card Is Tokenized

Next Steps

Manage Tokens

Use Tokens

​Collecting Cards from the Cardholder

​Receiving Cards from a Third Party via HTTP

​Receiving Cards from a Third Party via File

​Direct API (Card Migration)

​What Happens When a Card Is Tokenized

​Next Steps

Manage Tokens

Use Tokens

Collecting Cards from the Cardholder

Receiving Cards from a Third Party via HTTP

Receiving Cards from a Third Party via File

Direct API (Card Migration)

What Happens When a Card Is Tokenized

Next Steps