Skip to main content
POST
Issue a card to a cardholder

Authorizations

X-Numero-Api-Key
string
header
required

Your business API key (live_key_...). Issued on approval; managed in Dashboard → Settings → Developer.

X-Numero-Signature
string
header
required

Base64(HMAC-SHA256(publicApiKey, input)) over the raw request body (POST) or canonicalized query string (signed GET). Also send X-Numero-Signature-Version: v2. Required on money-movement / state-changing endpoints (marked 🔒).

The HMAC key is your Public Key as raw UTF-8 bytes — a SECRET despite the name, and a different value from the X-Numero-Api-Key authentication header. Signing with the API key will never produce a valid signature.

Path Parameters

customerId
string
required

Body

application/json
productCode
string
Example:

"USD_VIRTUAL"

capability
enum<string> | null

Card type — optional; every card is wallet-enabled. APPLE_PAY / GOOGLE_PAY.

Available options:
USD,
APPLE_PAY,
GOOGLE_PAY,
null
Example:

"APPLE_PAY"

label
string | null
initialBalance
number
Example:

5

brand
string | null
Example:

"visa"

Response

The card (masked only)

Canonical response envelope for the public surface. data on success, error on failure.

data
object
required

A card as exposed to you — masked only.

error
object | null
required
meta
object
required