Get Order Intent Credentials

Create a payment credential from an order intent.

API scope required: order-intents.credentials

POST /unstable/order-intents/{orderIntentId}/credentials

cURL

Card Network Token

curl --request POST \
  --url https://staging.crossmint.com/api/unstable/order-intents/{orderIntentId}/credentials \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-API-KEY: <api-key>' \
  --data '
{
  "amount": {
    "currency": "USD",
    "value": "25.00"
  },
  "credential": {
    "format": "card"
  },
  "merchant": {
    "countryCode": "US",
    "name": "Acme Store",
    "url": "https://acme.example.com"
  },
  "provider": "vic",
  "rail": "agentic-token"
}
'

201

{
  "amount": {
    "currency": "<string>",
    "value": "<string>"
  },
  "credential": {
    "format": "card",
    "value": "<string>"
  },
  "expiresAt": "2024-01-15T10:30:00.000Z",
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "rail": "encrypted-card"
}

Authorizations

X-API-KEY · string · header · required

API key required for authentication

Authorization · string · header · required

The end user's JWT, sent as Authorization: Bearer <JWT> together with a client-side API key. Validated against the project's external JWT configuration.

Headers

Idempotency-Key · string

Makes a retry of this request safe: a second call with the same key never consumes the amount again. Credential payloads are returned once, so a replay after a successful mint answers 409 ORDER_INTENT_CREDENTIAL_ALREADY_ISSUED. Without it every call is a new mint. 1 to 255 characters.

Path Parameters

orderIntentId · string · required

Body

application/json

Option 1

Option 2

Option 3

amount · object · required

Show child attributes

credential · object · required

Show child attributes

rail · string · required

Allowed value: "encrypted-card"

merchant · object

Show child attributes

Response

201

application/json

Returns the payment credential

Option 1

Option 2

Option 3

amount · object · required

Show child attributes

credential · object · required

Show child attributes

expiresAt · string<date-time> · required

ISO 8601. A UTC offset is accepted. Fractional seconds are optional.

Example:

"2024-01-15T10:30:00.000Z"

id · string<uuid> · required

Pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$

rail · string · required

Allowed value: "encrypted-card"