Secure Card Capture

Secure Card Capture key pairs are used to encrypt cardholder data client-side (via Verifone.JS or Verifone Checkout) before it is transmitted to the API. The public_key_alias returned here is required on all encrypted card requests.

Encrypted card data is only valid for 15 minutes after capture. Ensure the captureTime is included in the JSON payload before encryption.

Generate Key Pair

Creates a new public/private key pair and returns the public key and its alias.

Generate Key Pair

post

/api/v2/key

Generate a new public/private key pair

Authorizations

AuthorizationstringRequired

Responses

201

Key Result

application/json

public_keystringRequired

This is the public key required to encrypt the card data at client side before sending to Greenbox

public_key_aliasstringRequired

Public Key Alias

created_atstring · date-timeRequired

The time that this key was created.

400

Bad Request

application/json

401

Unauthorised

application/json

403

Forbidden

application/json

404

Not Found

application/json

500

Internal Server Error

application/json

post/api/v2/key

POST /oidc/api/v2/key HTTP/1.1
Host: emea.gsc.verifone.cloud
Authorization: Basic username:password
Accept: */*

{
  "public_key": "text",
  "public_key_alias": "text",
  "created_at": "2026-01-01T00:00:00.000Z"
}

List Active Key Pairs

Returns all currently active public keys. Share these with client-side integrations to encrypt card data.

List Key Pair

get

/api/v2/key

This will return the active public keys that can be shared with a merchant to encrypt card data prior to send.

Authorizations

AuthorizationstringRequired

Responses

200

Key Result

application/json

400

Bad Request

application/json

401

Unauthorised

application/json

403

Forbidden

application/json

404

Not Found

application/json

500

Internal Server Error

application/json

get/api/v2/key

GET /oidc/api/v2/key HTTP/1.1
Host: emea.gsc.verifone.cloud
Authorization: Basic username:password
Accept: */*

{
  "public_keys": [
    {
      "public_key": "text",
      "public_key_alias": "text",
      "created_at": "2026-01-01T00:00:00.000Z"
    }
  ]
}

Deactivate Key Pair

Sets a key pair's status to inactive. Requests using this key alias will be rejected after deactivation.

Deactivating a key pair will cause all in-flight encrypted card payloads using that alias to fail. Coordinate rollover carefully.

Deactivate Key Pair

patch

/api/v2/key/{keyAlias}/deactivate

This sets the status of the key pair to inactive.

Authorizations

AuthorizationstringRequired

Path parameters

keyAliasstringRequired

Responses

204

Success. Key pair deactivated.

No content

400

Bad Request

application/json

401

Unauthorised

application/json

403

Forbidden

application/json

404

Not Found

application/json

500

Internal Server Error

application/json

patch/api/v2/key/{keyAlias}/deactivate

PATCH /oidc/api/v2/key/{keyAlias}/deactivate HTTP/1.1
Host: emea.gsc.verifone.cloud
Authorization: Basic username:password
Accept: */*

No content

Encryption Payload Format

The JSON to encrypt must include the card data fields and a captureTime in UTC RFC 3339 format. Example:

{
  "cardNumber": "4929123123123127",
  "cardholderName": "MR J HOLDER",
  "expiryMonth": "12",
  "expiryYear": "2026",
  "cvv": "123",
  "captureTime": "2024-06-01T14:15:22Z"
}

Encrypt the entire JSON as a single line (no whitespace) using the public key. Pass the Base64-encoded result as encrypted_card, along with public_key_alias, in your payment or token request.