> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ozura.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Tokenize

> Create a token from card or bank account data.

# POST /tokenize

Create a token from sensitive card or bank account data. Card data can include an optional CVV, which is stored in a separate **CVC session** (90-second TTL; deleted after use in proxy).

**Auth:** **X-API-Key** (or JWT) is always required. **X-Pub-Key** is required when using a production vault API key; test/sandbox API keys do not require it. Get an API key by creating an account at [Ozura Vault](https://ozuravault.com). For a production pub key, contact **[ammar@ozura.com](mailto:ammar@ozura.com)**.

## Request

```json theme={null}
{
  "type": "card",
  "data": {
    "cardNumber": "4111111111111111",
    "expirationMonth": "12",
    "expirationYear": "2029",
    "cvv": "123"
  }
}
```

### Request body

| Field | Type | Required | Description |
| - | - | - | - |
| `type` | string | Yes | `"card"` or `"bank"` |
| `data.cardNumber` | string | Yes (card) | 13–19 digit card number |
| `data.expirationMonth` | string | Yes (card) | 2-digit month (01–12) |
| `data.expirationYear` | string | Yes (card) | 2- or 4-digit year |
| `data.cvv` | string | No | 3–4 digit security code |
| `data.cvc` | string | No | Alias for `cvv` |

### CVV/CVC handling

* If `cvv` or `cvc` is provided: stored in a separate CVC session, **90-second TTL**, deleted after use in proxy; response includes `cvc_session_id`.
* If omitted: no CVC session; no `cvc_session_id` in response; CVC cannot be used in proxy.

For long-lived test CVC sessions (e.g. 1-year), use [POST /test-tokens](/api-reference/vault/test-tokens).

## Response

### 201 Created

```json theme={null}
{
  "success": true,
  "token": "tok_a1b2c3d4e5f6g7h8i9j0",
  "mask": {
    "card_number": "411111******1111"
  },
  "cvc_session_id": "550e8400-e29b-41d4-a716-446655440000",
  "bin": "411111"
}
```

| Field | Type | Description |
| - | - | - |
| `success` | boolean | Request success |
| `token` | string | Token identifier |
| `data` | object | Masked payload (e.g. `number`, `expiration_month`, `expiration_year`) for display |
| `mask.card_number` | string | Masked card for display |
| `cvc_session_id` | string | Present if CVV was sent |
| `bin` | string | First 6 digits (BIN) |
| `fingerprint` | string | If deduplication enabled |
| `deduplicated` | boolean | If existing token was returned |

Request may include optional `maskingConfig` for custom masking behavior.

## Validation

* **Card number:** 13–19 digits, Luhn valid; spaces/dashes stripped.
* **Expiration:** month 01–12; year current or future.
* **CVV:** 3 digits (Visa, MC, Discover), 4 (Amex).

## Error responses

| Status | Example message |
| - | - |
| 400 | `Invalid card number`, `Card has expired`, `Missing required field: cardNumber` |
| 401 | `Invalid API key` |
| 403 | Permission denied |

See [Status codes](/api-reference/vault/status-codes) and [Common errors](/api-reference/vault/common-errors).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.