Programmatic card issuing at global scale.
One REST endpoint to spin up virtual and physical cards in any supported region — with native controls for limits, merchants, and lifecycle events.
{ "status":"authorized", "card":"tok_8fK3" }Built for the way modern teams ship card programs.
Tokenized virtual cards in under 200ms.
Issue a fully tokenized card with a single POST and push it directly into Apple Pay or Google Pay before the user closes the modal. Order embossed plastic with the same call.
POST /shop/card/create
X-Shop-No: NOVA20260114012345
X-Public-Key: 7c9c9e7b-a8d2-4f1c-9b3e-2a91f4d0e7c4
Content-Type: application/json
{
"bin": "428392",
"currency": "USD",
"amount": 5000,
"remark": "ads-google-q2",
"callback_url": "https://merchant.example.com/hooks/card"
}
→ { "code": 200, "data": { "cardNo": "tok_8fK3a91c", "status": "ACTIVE" } }Authorization-time rules, enforced at the edge.
Per-card limits on amount, MCC, merchant, geography, and time-of-day. Rules evaluated against 80+ signals in under 8ms — declines surface before the merchant sees a hold.
Group thousands of cards into a single program.
Shared BIN, branding, reporting, and lifecycle webhooks. Onboard a new card project in an afternoon without touching the sponsor bank's portal.
More details engineers care about.
Native EMV 3DS 2.2 with frictionless flows.
Cardholder verification handled in-app, no redirect to issuer pages.
Apple Pay & Google Pay push provisioning.
Every card state, streamed in real time.
card.created · activated · suspended · terminated — webhook for each.
PCI Level 1.
Audited annually by an external QSA.