Authorize a Card using TaaS
The POST /v1/tokenizer/proxy endpoint allows enterprise merchants to securely authorize transactions with their preferred payment processors (PSPs) by proxying requests through Bolt's PCI-compliant infrastructure. This API is part of Bolt's Tokenization-as-a-Service (TaaS) platform, enabling merchants to inject sensitive card data (e.g., PAN, CVV) into PSP-native request formats without directly handling raw card data.
The proxy replaces placeholders in the merchant-defined request body with actual card data retrieved securely using the provided x-bolt-taas-id, and forwards the complete request to the specified x-bolt-forward-to URL using the HTTP method specified in x-bolt-forward-verb.
Authorization
X-API-Key Admins and Developers can obtain their Bolt API key from the Bolt Merchant Dashboard.
In: header
Header Parameters
The fully qualified URL of the payment service provider (PSP) endpoint to which the request should be proxied. This URL must be whitelisted in advance by Bolt.
Provide your Tokenizer-as-a-Service (TaaS) identifier. This value tells Bolt which stored payment method to use when injecting sensitive data into the proxied request. The value must be in the following format:
bolt_token:{token}- Reference a Bolt-issued short-term token
Merchant-scoped long-term tokens will be supported in a future release. Example usage allows Bolt to securely inject PAN, CVV, and expiration into the forwarded request body.
The HTTP method to use when forwarding the request to the payment service provider (PSP) endpoint. This allows merchants to specify the appropriate HTTP verb for their PSP's API requirements.
Value in
- "POST"
- "PUT"
- "PATCH"
Request Body
application/json
Use this API to proxy an authorization request to a third-party PSP endpoint using Bolt's secure infrastructure.
- Replace raw card fields (e.g., card[number]) with placeholders like
{{tk:cc}},{{tk:cvv}},{{tk:exp_month}}, etc. - The placeholders will be securely replaced by Bolt using the identifier from
x-bolt-taas-id. - The
x-bolt-forward-toheader must point to a whitelisted PSP URL. - The
x-bolt-forward-verbheader specifies the HTTP method (POST, PUT, or PATCH) for the PSP request.
Never submit raw PAN, CVV, or expiration directly. Use placeholders. Supported placeholders:
{{tk:cc}}– Full card number{{tk:cvv}}– Card CVV{{tk:exp_month}}– Expiration month{{tk:exp_year}}– Expiration year
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/tokenizer/proxy" \ -H "X-Bolt-Forward-To: https://api.stripe.com/v1/payment_methods" \ -H "X-Bolt-Taas-Id: bolt_token:your_bolt_token_here" \ -H "X-Bolt-Forward-Verb: POST" \ -H "Content-Type: application/json" \ -d '{ "type": "card", "card": { "number": "{{tk:cc}}", "exp_month": "{{tk:exp_month}}", "exp_year": "{{tk:exp_year}}", "cvc": "{{tk:cvv}}" }, "billing_details": { "name": "Jane Doe", "address": { "postal_code": "94107" } } }'{ "status_code": 200, "body": "{\"id\":\"pm_1NQzWT2eZvKYlo2C\",\"object\":\"payment_method\",\"type\":\"card\",\"card\":{\"last4\":\"4242\",\"brand\":\"visa\",\"exp_month\":12,\"exp_year\":2026}}", "header": { "Content-Type": [ "application/json" ] }, "proxy_operation_id": "PROXY-ABC123-DEF456-GHI789"}