Reveal card details
curl --request POST \
--url https://api.global.direct.reap.global/2026-07-13/cards/{cardId}/reveal \
--header 'x-api-key: <api-key>'const options = {method: 'POST', headers: {'x-api-key': '<api-key>'}};
fetch('https://api.global.direct.reap.global/2026-07-13/cards/{cardId}/reveal', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.global.direct.reap.global/2026-07-13/cards/{cardId}/reveal"
headers = {"x-api-key": "<api-key>"}
response = requests.post(url, headers=headers)
print(response.text){
"accessUrl": "https://secure.card.reap.global/api/card/show-card-info?auth=temporary-token©Pan=true"
}Cards
Reveal card details
Required API-key scope: cards:read_vault.
Returns a short-lived link to a secure, Reap-hosted page that shows the card number, expiry date and CVV, for you to display in an iframe. The link expires after 1 minute, and the card details never pass through your servers. Always call this endpoint from your backend, and only for people allowed to see the card. See Card details.
POST
/
2026-07-13
/
cards
/
{cardId}
/
reveal
Reveal card details
curl --request POST \
--url https://api.global.direct.reap.global/2026-07-13/cards/{cardId}/reveal \
--header 'x-api-key: <api-key>'const options = {method: 'POST', headers: {'x-api-key': '<api-key>'}};
fetch('https://api.global.direct.reap.global/2026-07-13/cards/{cardId}/reveal', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.global.direct.reap.global/2026-07-13/cards/{cardId}/reveal"
headers = {"x-api-key": "<api-key>"}
response = requests.post(url, headers=headers)
print(response.text){
"accessUrl": "https://secure.card.reap.global/api/card/show-card-info?auth=temporary-token©Pan=true"
}Display card details securely
This endpoint returns one short-lived URL for a Reap-hosted card-details widget. The widget displays the card number, expiry date, and CVV together and includes a control for copying the card number. It does not display the billing address. Sensitive card data is never returned to your backend or parent-page JavaScript.Call this endpoint from your backend. Never expose your API key in browser or mobile application code.
1
Request an access URL from your backend
Call the endpoint when an authenticated and authorized user opens the card-details view. Keep the API key in your backend’s secrets manager.Return only the short-lived
const apiKey = process.env.REAP_DIRECT_API_KEY;
if (!apiKey) {
throw new Error("REAP_DIRECT_API_KEY is not configured");
}
const response = await fetch(
`https://api.global.direct.reap.global/2026-07-13/cards/${encodeURIComponent(cardId)}/reveal`,
{
method: "POST",
headers: {
"x-api-key": apiKey,
},
},
);
if (!response.ok) {
throw new Error(`Card reveal failed with status ${response.status}`);
}
const { accessUrl } = await response.json();
accessUrl to your frontend through your own authenticated session. Do not log or persist it.2
Render the card details
Use the returned URL directly as the source of one iframe. Do not parse, modify, or reconstruct it.Set the iframe’s
<iframe
id="reap-card-details"
title="Card details"
sandbox="allow-scripts allow-same-origin"
allow="clipboard-write"
referrerpolicy="no-referrer"
style="width: 100%; height: 180px; color-scheme: light; border: 0"
></iframe>
const iframe = document.querySelector<HTMLIFrameElement>(
"#reap-card-details",
);
if (!iframe) {
throw new Error("Card-details iframe was not found");
}
iframe.src = accessUrl;
color-scheme to light or dark to match your page, or omit it to use the browser’s inherited color preference (normally the user’s system preference). Your application can style the iframe element and its container, but it cannot directly style or inspect the cross-origin contents.3
Discard the access URL
The URL is short-lived. Clear the iframe source and discard the URL when the card-details view closes. Request a fresh URL whenever the user opens or retries the view.
Security requirements
- Keep your API key on your backend.
- Return the access URL only to an authenticated user who is authorized to view that card.
- Keep the URL only in memory for the active card-details view. Do not log, persist, decode, inspect, or modify it.
- Do not send the URL to analytics, error reporting, or session-replay tools.
- Use the iframe sandbox, clipboard permission, and no-referrer policy shown above.
Troubleshooting
| Symptom | Resolution |
|---|---|
The API returns 401 | Check that the backend supplied a valid API key. |
The API returns 403 | Confirm the key has the cards:read_vault scope and that the request satisfies its IP restrictions. Use the response code to distinguish the cause. |
The API returns 404 | Confirm the card ID belongs to the authenticated business and is available. |
| The iframe is empty or reports that card data is unavailable | Request a fresh access URL and replace the iframe source. |
| The iframe renders blank | If the frame renders blank on your domain, your origin isn’t allowlisted; contact Reap to enable embedding, or open the URL in a new tab instead. |
| The copy control does not work | Confirm the iframe includes allow="clipboard-write" and that the browser permits clipboard access. |
| The browser refuses to frame the widget | Confirm the iframe uses the returned HTTPS URL directly and is not being blocked by the application’s own Content Security Policy. |
Authorizations
Enter your API key
Path Parameters
The card's ID, as returned by List cards or Create card.
Response
A link to a secure, Reap-hosted page that shows the card number, expiry date and CVV. Load it in an iframe straight away: it expires after 1 minute and must never be stored or logged.