elements.ozura.com — raw card and bank data never exist in your JavaScript bundle, your DOM, or your server logs.
Key Concepts
Isolated iframes
Every payment field (card number, CVV, account number, etc.) renders inside a cross-origin iframe hosted by Ozura. Your page controls the layout and styling, but cannot read the raw value inside. Sensitive data never touches your JavaScript or your server.Secure tokenization
When you callcreateToken() or createBankToken(), the SDK securely transmits the field values directly to the Ozura Vault API. Your code receives a vault token — never the raw card or bank data.
Session key
A short-lived credential created by your server for each checkout session. Point the SDK at your session endpoint viasessionUrl and the SDK handles the rest — your server exchanges the session ID for a key from the vault using your private vault key. The vault key never goes to the browser.
PCI scope reduction
Because sensitive data never reaches your JavaScript or your server, your PCI DSS surface area is significantly reduced. You only handle vault tokens.Bank tokens can be passed to any ACH-capable processor. Card tokens include a
cvcSession required by Ozura Pay for charging. If you are routing card payments to a different processor, use the token field directly — your processor’s documentation will tell you whether CVC vaulting is required. The cvcSession is enforced by the SDK on success, so if your processor does not need it, simply ignore it.Package Details
What’s in the Box
SDK Pages
Installation
npm, yarn, CDN. TypeScript setup.
Card Elements
createElement(), createToken(), field types, events.
Bank Elements
createBankElement(), createBankToken(), ACH tokenization.
React
OzElements provider, hooks, pre-built components.
Styling
Style config, supported properties, global appearance.
Error Handling
OzError, errorCode values, retry guidance.
Server SDK
Process payments and query transactions on your backend.
API Reference
Complete reference for all classes, methods, and types.