const params = new URLSearchParams({
accessToken: 'your-access-token',
brand: 'your-username',
cardUri: 'https://service.pcibooking.net/api/payments/paycard/865ed8bec1f84366b97112a69cdbf915',
language: 'en',
success: 'https://example.com/success',
failure: 'https://example.com/failure'
});
const formUrl = `https://service.pcibooking.net/api/payments/cvvcapturecard?${params}`;
// Use it as the iframe source
document.getElementById('cvv-form').src = formUrl;
<iframe id="cvv-form"
src="https://service.pcibooking.net/api/payments/cvvcapturecard?accessToken=your-access-token&brand=your-username&cardUri=https%3A%2F%2Fservice.pcibooking.net%2Fapi%2Fpayments%2Fpaycard%2F865ed8bec1f84366b97112a69cdbf915&language=en&success=https%3A%2F%2Fexample.com%2Fsuccess&failure=https%3A%2F%2Fexample.com%2Ffailure">
</iframe>
<!-- The hosted CVV capture form, rendered by the browser -->
Capture Cards
Request a Card Security Code Entry Form
Create a PCI Booking CVV capture form for use in an iFrame.
GET
/
api
/
payments
/
cvvcapturecard
const params = new URLSearchParams({
accessToken: 'your-access-token',
brand: 'your-username',
cardUri: 'https://service.pcibooking.net/api/payments/paycard/865ed8bec1f84366b97112a69cdbf915',
language: 'en',
success: 'https://example.com/success',
failure: 'https://example.com/failure'
});
const formUrl = `https://service.pcibooking.net/api/payments/cvvcapturecard?${params}`;
// Use it as the iframe source
document.getElementById('cvv-form').src = formUrl;
<iframe id="cvv-form"
src="https://service.pcibooking.net/api/payments/cvvcapturecard?accessToken=your-access-token&brand=your-username&cardUri=https%3A%2F%2Fservice.pcibooking.net%2Fapi%2Fpayments%2Fpaycard%2F865ed8bec1f84366b97112a69cdbf915&language=en&success=https%3A%2F%2Fexample.com%2Fsuccess&failure=https%3A%2F%2Fexample.com%2Ffailure">
</iframe>
<!-- The hosted CVV capture form, rendered by the browser -->
CVV Capture Guide
Collect CVV from cardholders via hosted forms
src of an iframe element on your page, or redirect the cardholder’s browser to it. The browser then loads the hosted CVV capture form directly from PCI Booking. For the element IDs and classes you can target with custom CSS, see the form structure reference.
Submitting this form creates a new token that is a full copy of the original card details plus the captured CVV. The original token is not modified and does not contain the CVV. You are responsible for deleting the original token if it is no longer needed, otherwise it will continue to incur monthly storage fees. Remember to set the CVV Retention Policy on the new token.
Parameters
Authentication
This is a browser-facing endpoint. Use one of the authentication methods below instead of the API key shown above.
string
Recommended. A long-lived token for browser-side calls. How to generate.
string
Alternative. Valid for 5 minutes. How to generate.
Form Configuration
All URLs passed as query parameters (
cardUri, success, failure) must be https and must be URL-encoded.string
required
Your PCI Booking username, used to identify your account.
string
required
The resource identifier (URI) for the card location within PCI Booking.
string
required
The form’s language in ISO 639-1 (2-letter) format - see here. If an unsupported language is provided, English will be displayed. To add languages, contact support.
string
The CSS resource name. See the guide on managing stylesheets. If omitted, the default CSS is applied.
boolean
default:"false"
Whether to remove the PCI Booking base CSS. The base CSS does not collide with the host site’s CSS. true: remove base CSS. false: use base CSS.
string
URL to redirect to on successful submission. Only the
{cardToken} placeholder is resolved by this form - see CVV capture success URLs.string
URL to redirect to on failed submission. See success/failure redirection pages.
boolean
Whether to exclude the PCI Booking submit button, allowing the host site to use its own button. true: exclude submit button. false: include submit button. See postMessage integration.
boolean
default:"true"
Whether the card security code field receives focus when the parent page loads.
string
The origin URL of the host page where the iframe is displayed, URL-encoded (e.g.
https%3A%2F%2Fwww.yoursite.com). Required for postMessage communication between the form and your page.string
A reference value that can be used to query for this card token later.
3D Secure
Visa requirement (Aug 2024): You must provide at least the cardholder’s
email or phone for 3DS authentication.boolean
default:"false"
Whether to perform 3D Secure authentication after card entry. If enabled with Access Token authorization, provide two access tokens.
string
default:"Accept"
Action to take if a technical problem occurs during 3DS processing. Accept: ignore 3DS failure and proceed with tokenization. Reject: do not tokenize the card; redirect to the failure URL.
The default,
Accept, means that if 3DS can’t complete, the card is still tokenized without 3DS data. If you later charge that token through a PSP that requires 3DS, the charge will be rejected. Set this to Reject if every token in your flow must have 3DS data.string
The merchant name for 3D Secure authentication. Must be URL-encoded and unique per 3DS merchant account. See 3DS merchant setup.
integer
default:"0"
Transaction amount for the 3D Secure challenge screen. Must be provided together with
currencyCode. If omitted, authentication uses a 0 EUR amount.string
default:"EUR"
Currency code for the 3D Secure challenge screen amount. Must be provided together with
amount. If omitted, authentication uses a 0 EUR amount.string
Cardholder’s email address for 3D Secure authentication. Must be a valid email format, e.g.
joe@bloggs.com.string
Cardholder’s telephone number for 3D Secure authentication. May only contain digits [0-9], e.g.
00353112223344.const params = new URLSearchParams({
accessToken: 'your-access-token',
brand: 'your-username',
cardUri: 'https://service.pcibooking.net/api/payments/paycard/865ed8bec1f84366b97112a69cdbf915',
language: 'en',
success: 'https://example.com/success',
failure: 'https://example.com/failure'
});
const formUrl = `https://service.pcibooking.net/api/payments/cvvcapturecard?${params}`;
// Use it as the iframe source
document.getElementById('cvv-form').src = formUrl;
<iframe id="cvv-form"
src="https://service.pcibooking.net/api/payments/cvvcapturecard?accessToken=your-access-token&brand=your-username&cardUri=https%3A%2F%2Fservice.pcibooking.net%2Fapi%2Fpayments%2Fpaycard%2F865ed8bec1f84366b97112a69cdbf915&language=en&success=https%3A%2F%2Fexample.com%2Fsuccess&failure=https%3A%2F%2Fexample.com%2Ffailure">
</iframe>
Response
200 - The browser renders the hosted CVV capture form.<!-- The hosted CVV capture form, rendered by the browser -->