A card token is a temporary, single-use representation of a card, created from card and cardholder information. It replaces the raw card number everywhere — including inside TrieOH: the Univents checkout tokenizes cards in the browser with @mercadopago/sdk-js and sends only the token to the backend. This page documents the raw Mercado Pago API for reference and debugging.

Test and production environments

Environment	Credentials	Card and cardholder data	Transactions
Test	Mercado Pago test credentials (`MP_TEST_ACCESS_TOKEN`, `MP_TEST_PUBLIC_KEY`)	Mercado Pago test cards and test payer data	Simulated; no real charge
Production	Mercado Pago production credentials	Real card and cardholder data	Real payment; the cardholder may be charged

In production, use production credentials and real card and cardholder data. The test values shown below are only for test mode.

See the official Mercado Pago documentation for credentials and test cards.

Create card token

Creates a temporary token from card and cardholder information.

POST https://api.mercadopago.com/v1/card_tokens

Authentication

Send the Mercado Pago Access Token for the selected environment as a Bearer token.

Authorization: Bearer ACCESS_TOKEN

Headers

Header	Type	Required	Description
`Authorization`	string	Yes	Bearer Access Token for the current environment.
`Content-Type`	string	Yes	Must be `application/json`.

Request body

Field	Type	Required	Description
`card_number`	string	Yes	Card number.
`expiration_year`	string	Yes	Expiration year.
`expiration_month`	string	Yes	Expiration month.
`security_code`	string	Yes	Security code.
`cardholder`	object	Yes	Cardholder information.
`cardholder.name`	string	Yes	Cardholder name.
`cardholder.identification`	object	Yes	Cardholder identification document.
`cardholder.identification.type`	string	Yes	Identification type (e.g. `CPF`, `CNPJ`).
`cardholder.identification.number`	string	Yes	Identification number.

Test request

Set a test Access Token in your shell:

export MERCADO_PAGO_ACCESS_TOKEN="replace-with-test-access-token"

Create a card token using Mercado Pago test data:

curl --request POST \
  --url https://api.mercadopago.com/v1/card_tokens \
  --header "Authorization: Bearer ${MERCADO_PAGO_ACCESS_TOKEN}" \
  --header "Content-Type: application/json" \
  --data '{
    "card_number": "5031433215406351",
    "expiration_year": "2030",
    "expiration_month": "11",
    "security_code": "123",
    "cardholder": {
      "name": "APRO",
      "identification": {
        "type": "CPF",
        "number": "12345678909"
      }
    }
  }'

Production request

The endpoint and request structure are the same in production. Replace the test Access Token and all test values with production credentials and real card and cardholder data.

export MERCADO_PAGO_ACCESS_TOKEN="replace-with-production-access-token"

In TrieOH (the frontend way)

The raw API above is what the Mercado Pago SDK wraps. In our frontends (see Univents checkout) the flow is:

Load the SDK: loadMercadoPago() from @mercadopago/sdk-js.
Create the instance with the seller's public key (from the event's payssage_public_key): new window.MercadoPago(publicKey, { locale: "pt-BR" }).
Mount mp.cardForm({ iframe: true, … }) — card number, expiry, and CVV live in Mercado Pago iframes and never touch your DOM state.
On submit, getCardFormData() returns { token, issuerId, paymentMethodId, installments, identificationNumber, identificationType, cardholderEmail }.
Send { card_token, payment_method_id, installments, issuer_id, payer: { email, identification: { type, number } } } to the checkout endpoint (Payssage intent).

Never send raw card numbers to TrieOH backends — only the token. Cards charge synchronously at checkout; Pix returns a QR code instead.

Card Tokens