Card encryption (JWE)

Sensitive card data is delivered on GET /partner/cards/{card_id}. Default tenant mode: card_payload=jwe. Do not expect PAN / CVV / JWE in webhooks — always fetch via GET.

Keys

Key	Purpose
Ed25519 credential	Sign assertion JWTs (`kid`)
X25519 `jwe_public_key`	Encrypt `card_encrypted` for you

These keys are separate. Do not reuse the signing key for JWE.

Algorithm

Compact JWE:

alg: ECDH-ES
enc: A256GCM
Empty encrypted key segment (compact form has .. between protected header and IV)

Protected header example (IMBA does not put kid in the JWE header):

{
  "alg": "ECDH-ES",
  "enc": "A256GCM",
  "epk": {
    "kty": "OKP",
    "crv": "X25519",
    "x": "<base64url ephemeral public key>"
  }
}

Your key id (if you use one in your keystore) is for your selection only.

Response shape (JWE mode)

{
  "card_id": "00112233445566778899aabb",
  "number_masked": "411111******1111",
  "card_encrypted": "<compact JWE>",
  "card": null
}

Decrypt card_encrypted with your X25519 private key. Plaintext JSON typically includes number (PAN), cvv, expiration (typically MM/YYYY), holder, card_id, currency, status. That GET is the automated delivery of card credentials after card_issued — not the webhook.

Plaintext mode

If IMBA enables card_payload=plaintext for your tenant, secrets appear under card instead of card_encrypted. Prefer JWE in production. Never log secrets.

Get started

Money

Products

Operations

Card encryption (JWE)

Keys

Algorithm

Response shape (JWE mode)

Plaintext mode

​Keys

​Algorithm

​Response shape (JWE mode)

​Plaintext mode

Keys

Algorithm

Response shape (JWE mode)

Plaintext mode