Charge Tokenized Card
POST
/v1/payments/cardCoreCharge a card using a vault token (never a raw PAN — tokenize first via POST /v1/cards/tokens). Handles the 3DS 2.0 challenge dance. Set capture=false for a preauthorization (Slice 9): the row lands at status="authorized" with no ledger entries until a follow-up /capture or /void.
Authentication
Signature Pattern
HMAC-SHA256(secretKey, "{timestamp}\nPOST\n/v1/payments/card\n{sha256(body)}")| Header | Value | Description |
|---|---|---|
X-Api-Key | pk_live_a1b2c3d4e5f6g7h8 | Merchant public API key |
X-Signature | {hmac_sha256_hex} | Hex HMAC-SHA256 request signature (see below) |
X-Timestamp | 2026-04-13T10:00:00Z | ISO 8601 UTC request time, validated within ±5 min |
Request Parameters
| Name | Type | Required | Description |
|---|---|---|---|
transactionId | string | Required | Session transaction id (idempotency fence) |
amount | integer | Required | Amount in kuruş |
currency | string | Required | Always "TRY" |
cardToken | string | Required | Vault token (tok_…) from POST /v1/cards/tokens |
installmentCount | integer | Optional | Installment count 1..12 (re-checked against installment-service) |
threeDSecure | boolean | Optional | Force 3DS (default true) |
customerId | string | Optional | Save-card is honored only for a session-bound customer |
saveCard | boolean | Optional | Attach the card to the customer after capture |
capture | boolean | Optional | Auto-capture (default true); false = preauth |
Request Example
JSONRequest Body
{
"transactionId": "ORDER-2026-001",
"amount": 15000,
"currency": "TRY",
"cardToken": "tok_9f8e7d6c5b4a",
"installmentCount": 3
}Response Parameters
| Field | Type | Example |
|---|---|---|
paymentId | string | "pay_1a2b3c4d5e6f" |
status | string | "captured" |
amount | integer | 15000 |
currency | string | "TRY" |
commission | integer | 449 |
netAmount | integer | 14551 |
cardMask | string | "415565******4321" |
cardBrand | string | "visa" |
cardType | string | "credit" |
installmentCount | integer | 3 |
threeDSecure | boolean | true |
authCode | string | "123456" |
createdAt | string | "2026-04-13T10:00:00Z" |
completedAt | string | "2026-04-13T10:00:02Z" |
Response Example
JSONResponse
{
"paymentId": "pay_1a2b3c4d5e6f",
"status": "captured",
"amount": 15000,
"currency": "TRY",
"commission": 449,
"netAmount": 14551,
"cardMask": "415565******4321",
"cardBrand": "visa",
"cardType": "credit",
"installmentCount": 3,
"threeDSecure": true,
"authCode": "123456",
"createdAt": "2026-04-13T10:00:00Z",
"completedAt": "2026-04-13T10:00:02Z"
}Status Codes
200Success
201Created
400Bad Request
401Unauthorized
404Not Found
429Rate Limited
Try itMock
POSThttps://api.pay.sandbox.kvell.group