> ## Documentation Index
> Fetch the complete documentation index at: https://api-docs.imbawallet.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Card encryption (JWE)

> ECDH-ES + A256GCM on your X25519 public key.

# Card encryption (JWE)

Sensitive card data is delivered on `GET /partner/cards/{card_id}`. Default tenant mode: `card_payload=jwe`.

Do not expect PAN / CVV / JWE in webhooks — always fetch via GET.

## Keys

| Key                     | Purpose                          |
| ----------------------- | -------------------------------- |
| Ed25519 credential      | Sign assertion JWTs (`kid`)      |
| X25519 `jwe_public_key` | Encrypt `card_encrypted` for you |

These keys are **separate**. Do not reuse the signing key for JWE.

## Algorithm

Compact JWE:

* `alg`: `ECDH-ES`
* `enc`: `A256GCM`
* Empty encrypted key segment (compact form has `..` between protected header and IV)

Protected header example (IMBA does **not** put `kid` in the JWE header):

```json theme={null}
{
  "alg": "ECDH-ES",
  "enc": "A256GCM",
  "epk": {
    "kty": "OKP",
    "crv": "X25519",
    "x": "<base64url ephemeral public key>"
  }
}
```

Your key id (if you use one in your keystore) is for **your** selection only.

## Response shape (JWE mode)

```json theme={null}
{
  "card_id": "00112233445566778899aabb",
  "number_masked": "411111******1111",
  "card_encrypted": "<compact JWE>",
  "card": null
}
```

Decrypt `card_encrypted` with your X25519 private key. Plaintext JSON typically includes `number`, `cvv`, `expiration`, `holder`, `card_id`, `currency`, `status`.

## Plaintext mode

If IMBA enables `card_payload=plaintext` for your tenant, secrets appear under `card` instead of `card_encrypted`. Prefer JWE in production. Never log secrets.