Card Payment Methods
Learn about card payment methods for accepting credit and debit cards, brand and issuer detection, tokenization, and secure storage
Card payment methods represent credit and debit cards as tokenized payment methods within the Payload system. A card can be used for a single one-time payment, or stored for reuse across recurring billing, autopay, and future transactions without re-collecting card details. Payload handles brand and issuer detection, tokenization, verification, and secure storage so you never have to persist raw card data.
Card payment methods can be created via the Payment Method API, through a Payment Form, or inline while processing a transaction. Payload tokenizes the card and returns a payment method ID for future use.
What Are Card Payment Methods?
Card payment methods store a customer's credit or debit card as a tokenized payment instrument that can be charged now or reused later.
When you create a card payment method, Payload:
- Tokenizes the card: Raw card data is exchanged for a secure token; your systems only ever handle the resulting payment method ID.
- Detects the brand, issuer, and type: The card brand (Visa, Mastercard, American Express, Discover, and others), the issuing bank, and whether the card is credit, debit, or prepaid are determined automatically from the card number.
- Masks sensitive details: Responses include only the last four digits and expiry, never the full card number or security code.
- Verifies the card: When a security code (CVV) or billing address is provided, Payload runs CVV and AVS checks to help confirm the cardholder.
- Stores it for reuse: The payment method is stored and can be charged again without
re-collecting details, for as long as
keep_activeistrue(the default). Associating it with a customer account is optional.
Key Characteristics
- Reusable: Charge a stored card across multiple transactions, including subscriptions and autopay
- Auto-Updating: Account Updater keeps stored cards current when they expire or are reissued, so recurring payments keep working
- Verified: AVS and CVV checks help confirm the cardholder
- Secure: Sensitive card data is tokenized and never stored on your systems
PCI Compliance: When collecting card details directly via the API, your integration must be PCI DSS compliant. Never log or store raw card numbers, expiry dates, or security codes, and always transmit card data over HTTPS. Using a Payment Form offloads card collection to Payload-hosted fields and reduces your PCI scope.
Common Use Cases
One-Time Payments
Charge a card a single time for a purchase or invoice. You can include the card inline with the transaction, or create the payment method first and process a transaction against it.
Recurring Payments and Autopay
Store a card once and charge it on a schedule for subscriptions, memberships, or automatic invoice payment. See Billing Schedules and Autopay for recurring collection.
Saved Cards for Faster Checkout
Associate cards with a customer account so returning customers can pay without re-entering card details, improving conversion and reducing friction.
Funding Synthetic Accounts
Charge a card to fund synthetic account balances, such as letting customers top up a wallet with a card.
Security and Verification
Card data is collected and protected for a compliant integration, then verified to confirm the cardholder and reduce declines and fraud.
- Card Number & Expiration: Validated at creation to confirm the card is legitimate and not expired.
- CVV/CVC: Provide the security code at creation to validate card-not-present transactions; it is never stored.
- Address Verification (AVS): Match the billing address against the card issuer's records. See Address Verification for details and response handling.
Reducing PCI Scope: Prefer collecting card data through a Payment Form or hosted checkout so raw card details never touch your servers. Payload handles tokenization and secure storage on your behalf.
Testing
Use test cards to exercise approvals, declines, and edge cases before going live. See Test Cards for card numbers covering common scenarios.
Schema Reference
Complete card payment method schema:
typecard, bank_account, syntheticcardtype=card_card_number_checkbrandvisa, mastercard, american_express, discovercard_code^[0-9]+$card_number^[0-9]+$track1=nulltype=cardexpiry^(0[1-9]|1[0-2])([0-9]{2}|[0-9]{4})$card[track1]=nulltype=cardtypecredit, debit, prepaidtransfer_typetwo_way, send_only, receive_onlyaccount_holderaccount_id ID of Account^acct_[A-Za-z0-9]+$descriptionFor complete field documentation, see:
- Payment Methods API Reference - Payment method API details
- Transactions API Reference - Transaction API for charging cards
Next Steps
Start accepting and storing cards across one-time and recurring payments
Create and Store Cards
Create cards via the Payment Method API, collect them securely with a Payment Form, and store them for reuse, optionally associating them with customer accounts.
Verify and Protect Payments
Confirm cardholders with Address Verification and validate integrations using Test Cards.
Process Transactions
Use the Payment API to charge stored cards, and the Transaction API Reference to manage the full payment lifecycle.
Related Articles
- Creating Payment Methods via API - Create card payment methods programmatically
- Payment Form - Collect cards securely with hosted fields
- Address Verification - Verify cardholder billing details
- Test Cards - Test card numbers for common scenarios
- Bank Account Payment Methods - Learn about bank account payment methods
- Synthetic Account Payment Methods - Learn about synthetic account payment methods
- Payment Methods API Reference - Payment method API reference