Card Tokenization

Card tokenization exchanges a shopper’s card details for a card token: a short id that stands in for the card and holds none of its sensitive data. The exchange happens directly between the shopper’s browser or app and Beam, so the card number never reaches your server.

You can then create a charge with that token instead of a card number, and store the token to charge the same card again later.

Why use card tokenization

Any system that processes, sends, or stores raw card data is inside your PCI DSS scope. PCI DSS (Payment Card Industry Data Security Standard) is the set of technical and operational requirements that protect payment account data. Following it protects your business if card data is ever stolen.

Card tokenization keeps raw card data out of your systems entirely, which significantly reduces your PCI DSS scope and the compliance work that comes with it. You never process, log, or store the card number, so you cannot leak it.

You can read more about the standard on the official PCI DSS website .

How it works

Tokenization uses your publishable key, not your API key. The publishable key is safe to expose in client-side code, because it can only create card tokens. Your secret API key stays on your server. See Authentication.

Shopper enters their card details in your checkout form.
Your client tokenizes the card: your frontend posts the card details straight to Beam, authenticating with your publishable key. This request must come from the client. If it goes through your server, the card number passes through your systems and you lose the PCI DSS benefit.
Beam returns a token id: the response is just an id.
Your client sends the token to your server: only the token, never the card number.
Your server creates the charge: call POST /api/v1/charges with paymentMethodType CARD_TOKEN and the token id, authenticating with your API key.
Beam returns the charge: handle actionRequired as with any card charge, including a 3DS redirect. See Handle the charge creation response.
Finish the payment and wait for the charge.succeeded webhook.

Note

A card token is different from a network token. A card token is issued by Beam and used with CARD_TOKEN. A network token is issued by the card network for recurring payments. See Network Tokenization.

Next steps

Card Tokens API: how to create a token and charge it.
Charges API: the charge call that consumes the token.
Recurring Payments: charging a stored token again later.