Skip to Content
Doura Developer Docs Markdown llms.txt API 2026.08.03

Tokenization

Store a card once and charge it from any channel.

The API implements a tokenization system that:

  • Creates payment tokens from both Card Present and Card Not Present transactions
  • Maintains tokens that work across all channels (in-person and online)
  • Supports token creation and removal.

A token is a stored payment method with a pmt_tkn_ identifier. It can hold a card or an ACH bank account: any payment method a customer provides can be tokenized. Once created, it is charged exactly like any other payment method - which is what makes a card captured on a terminal reusable for an online charge, and vice versa. An ACH token is limited to sales; see ACH bank transfers.

Creating a token

Source Endpoint
A card presented on a terminal POST /payment-methods/physical
A card or bank account entered online POST /payment-methods/virtual

Physical tokenization performs a 1-cent authorization. Virtual tokenization creates a session with requestedAmount: 0.

The virtual endpoint returns a session you render with the Hosted Payment Form or the Payment SDK; the token is created once the customer submits the form.

Sales and authorizations also produce a token as a side effect. The resulting token is in transactionResponses[].paymentMethod.id. The top-level paymentMethod.id identifies the terminal, form, or token used to start the request. The redirect parameters can also carry the resulting token.

Charging a token

Operation Endpoint
Sale POST /transactions/token-sale
Authorization POST /transactions/token-auth

An ACH token can only be used for a token sale. Using one for an authorization is rejected with error code 2010 (InvalidPaymentMethodType). See ACH bank transfers.

Managing tokens

Operation Endpoint
Remove DELETE /payment-methods/token/{id}

Handling an uncertain token sale

A token sale is the one flow where an unclear outcome is most expensive, because there is no customer in front of the form to tell you what happened. A token sale that returns Interrupted might still have charged the customer.

Never retry an Interrupted token sale directly. Resolve the outcome with GET /transactions first.

Questions about your integration? Contact support@doura.ca.