Retrieve card PAN and CVC - EasyOnRamp Business API

Use GET /cards/{cardId}/secrets when your app needs to display the full card number or CVC. GET /cards/{cardId} only returns card metadata such as status, last4, expiry, type, and PIN state. The secrets endpoint never returns plaintext PAN or CVC. It uses the same session setup as Managing a card’s PIN:

Fetch your business RSA public key from GET /business/pin-crypto-key.
Generate a 32-character hex sessionKey locally.
Save sessionKey until you have decrypted the response (same key as for PIN flows).
Encrypt the session key with the public key and send it as the SessionId header.
Decrypt encryptedPan and encryptedCvc locally with the saved raw session key.

Request

GET /cards/CARD_ID/secrets

curl -s "https://b2b-api.easyonramp.com/api/v1/cards/CARD_ID/secrets" \
  -H "Authorization: Bearer YOUR_JWT" \
  -H "SessionId: ENCRYPTED_SESSION_ID"

Response

{
  "id": "card-uuid",
  "encryptedPan": {
    "iv": "<base64>",
    "data": "<base64>"
  },
  "encryptedCvc": {
    "iv": "<base64>",
    "data": "<base64>"
  }
}

Decrypt PAN and CVC

Use the same sessionKey you generated and saved for this request. Unlike PIN retrieval, PAN and CVC are decrypted as plain values and do not use PIN block formatting.

decrypt-card-secret.js

import crypto from 'crypto';

function decryptCardSecret(base64Secret, base64Iv, sessionKey) {
  const secret = Buffer.from(base64Secret, 'base64');
  const iv = Buffer.from(base64Iv, 'base64');
  const authTag = secret.subarray(-16);
  const ciphertext = secret.subarray(0, -16);
  const key = Buffer.from(sessionKey, 'hex');

  const decipher = crypto.createDecipheriv('aes-128-gcm', key, iv);
  decipher.setAuthTag(authTag);

  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
}

const pan = decryptCardSecret(response.encryptedPan.data, response.encryptedPan.iv, sessionKey);
const cvc = decryptCardSecret(response.encryptedCvc.data, response.encryptedCvc.iv, sessionKey);