Cards

Connect the person's own card

A one-hour, single-use link where the cardholder connects their own credit or debit card behind a passkey. Send it to them; never open it yourself.

The card is encrypted on the cardholder's device before it leaves the page. AgentPay never holds the number in clear and never stores the security code. Nothing is issued and nothing is prepaid: they keep their points.

POST/v1/cards/connect

Authorization: Bearer

Live API. A POST to /v1/cards issues a real card.

Authorizations

Authorizationstringrequired

Bearer token: Authorization: Bearer mk_live_.... Create a key in the AgentPay console under Developer, API keys.

Response200application/json

connect_idstring

The enrolment id.

connect_urlstring

The link for the cardholder. Safari or Chrome, on the phone they will approve purchases with.

expires_atstring

ISO 8601. One hour after creation.

statusstring

open.

instructionsstring

What to tell the cardholder, in plain words.

request_idstring

The request id, also in the X-Mooj-Request-Id header.

Errors

Status	Code	When
503	`own_card_unavailable`	Connecting a card is not switched on for the account.
502	`connect_failed`	The link could not be created. Retry.

Connect the person's own card

curl -X POST https://api.joomjoo.com/v1/cards/connect \
  -H "Authorization: Bearer $AGENTPAY_API_KEY"

const res = await fetch("https://api.joomjoo.com/v1/cards/connect", {
  method: "POST",
  headers: { Authorization: "Bearer " + process.env.AGENTPAY_API_KEY },
});
const data = await res.json();

import os, requests

res = requests.post(
    "https://api.joomjoo.com/v1/cards/connect",
    headers={"Authorization": "Bearer " + os.environ["AGENTPAY_API_KEY"]},
)
data = res.json()

200

{
  "connect_id": "6f1c...",
  "connect_url": "https://claim.joomjoo.com/add/6f1c...#...",
  "expires_at": "2026-11-03T15:00:00.000Z",
  "status": "open",
  "instructions": "Send the link to the cardholder. They open it in Safari or Chrome on the phone they will approve purchases with, type the card once, and lock it with a passkey. The security code is never stored. Then GET /v1/cards shows it with source \"own\".",
  "request_id": "req_a1b2c3"
}