Skip to main content
PCI DSS makes raw card numbers expensive to handle: any system that stores, transmits or displays them falls inside PCI scope. So Reveal card never returns the PAN, expiry or CVV. It returns an accessUrl to a secure, Reap-hosted window that shows them. Card details are only ever visible inside that window; there is no way to retrieve them through the API.

​
How it works

  • The accessUrl is valid for 1 minute. Request it when the cardholder clicks “Show card”, then load it immediately. Never store or log it; if it expires, call reveal again for a fresh one.
  • Call reveal from your backend only. Your API key must never reach a user’s device, and the cards:read_vault scope covers every card in the business.
  • Your app must check that the person asking is allowed to see the card before calling reveal.
The window matches the page’s color-scheme (light or dark). You can also open the URL directly outside an iframe. If the frame renders blank on your domain, your origin isn’t allowlisted; contact Reap to enable embedding, or open the URL in a new tab instead.

​
PCI DSS dos and don’ts

Keeping cardholder data out of PCI DSS scope depends entirely on how you handle the accessUrl. The rules: Do:
  • Call reveal from your backend only, when a user who is allowed to see the card asks for it.
  • Serve the accessUrl to the frontend of your own authenticated session, in memory only.
  • Load it in a single iframe (or a new tab), request a fresh URL each time the view opens, and discard it when the view closes.
  • Keep the API key in your backend’s secrets manager.
Don’t:
  • Let your API key reach a user’s device. cards:read_vault covers every card in the business.
  • Log, persist, decode or modify the URL, or send it to analytics, error-reporting or session-replay tools.
Cannot be done at all:
  • Retrieve the card number, expiry or CVV through the API. They only exist inside the Reap-hosted window.
  • Display card data anywhere outside that window, restyle its contents, or extract them into your own UI.
Confirm the implications for your environment with your compliance team.