Authorize a Card using TaaS

curl --request POST \
  --url https://api.boltapp.com/v1/tokenizer/proxy \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <api-key>' \
  --header 'X-Bolt-Forward-To: <x-bolt-forward-to>' \
  --header 'X-Bolt-Forward-Verb: <x-bolt-forward-verb>' \
  --header 'X-Bolt-Taas-Id: <x-bolt-taas-id>' \
  --data '
{
  "type": "card",
  "card": {
    "number": "{{tk:cc}}",
    "exp_month": "{{tk:exp_month}}",
    "exp_year": "{{tk:exp_year}}",
    "cvc": "{{tk:cvv}}"
  },
  "billing_details": {
    "name": "Jane Doe",
    "address": {
      "postal_code": "94107"
    }
  }
}
'

import requests

url = "https://api.boltapp.com/v1/tokenizer/proxy"

payload = {
    "type": "card",
    "card": {
        "number": "{{tk:cc}}",
        "exp_month": "{{tk:exp_month}}",
        "exp_year": "{{tk:exp_year}}",
        "cvc": "{{tk:cvv}}"
    },
    "billing_details": {
        "name": "Jane Doe",
        "address": { "postal_code": "94107" }
    }
}
headers = {
    "X-Bolt-Forward-To": "<x-bolt-forward-to>",
    "X-Bolt-Taas-Id": "<x-bolt-taas-id>",
    "X-Bolt-Forward-Verb": "<x-bolt-forward-verb>",
    "X-API-Key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'X-Bolt-Forward-To': '<x-bolt-forward-to>',
    'X-Bolt-Taas-Id': '<x-bolt-taas-id>',
    'X-Bolt-Forward-Verb': '<x-bolt-forward-verb>',
    'X-API-Key': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    type: 'card',
    card: {
      number: '{{tk:cc}}',
      exp_month: '{{tk:exp_month}}',
      exp_year: '{{tk:exp_year}}',
      cvc: '{{tk:cvv}}'
    },
    billing_details: {name: 'Jane Doe', address: {postal_code: '94107'}}
  })
};

fetch('https://api.boltapp.com/v1/tokenizer/proxy', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.boltapp.com/v1/tokenizer/proxy",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'type' => 'card',
    'card' => [
        'number' => '{{tk:cc}}',
        'exp_month' => '{{tk:exp_month}}',
        'exp_year' => '{{tk:exp_year}}',
        'cvc' => '{{tk:cvv}}'
    ],
    'billing_details' => [
        'name' => 'Jane Doe',
        'address' => [
                'postal_code' => '94107'
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-API-Key: <api-key>",
    "X-Bolt-Forward-To: <x-bolt-forward-to>",
    "X-Bolt-Forward-Verb: <x-bolt-forward-verb>",
    "X-Bolt-Taas-Id: <x-bolt-taas-id>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.boltapp.com/v1/tokenizer/proxy"

	payload := strings.NewReader("{\n  \"type\": \"card\",\n  \"card\": {\n    \"number\": \"{{tk:cc}}\",\n    \"exp_month\": \"{{tk:exp_month}}\",\n    \"exp_year\": \"{{tk:exp_year}}\",\n    \"cvc\": \"{{tk:cvv}}\"\n  },\n  \"billing_details\": {\n    \"name\": \"Jane Doe\",\n    \"address\": {\n      \"postal_code\": \"94107\"\n    }\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-Bolt-Forward-To", "<x-bolt-forward-to>")
	req.Header.Add("X-Bolt-Taas-Id", "<x-bolt-taas-id>")
	req.Header.Add("X-Bolt-Forward-Verb", "<x-bolt-forward-verb>")
	req.Header.Add("X-API-Key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.boltapp.com/v1/tokenizer/proxy")
  .header("X-Bolt-Forward-To", "<x-bolt-forward-to>")
  .header("X-Bolt-Taas-Id", "<x-bolt-taas-id>")
  .header("X-Bolt-Forward-Verb", "<x-bolt-forward-verb>")
  .header("X-API-Key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"type\": \"card\",\n  \"card\": {\n    \"number\": \"{{tk:cc}}\",\n    \"exp_month\": \"{{tk:exp_month}}\",\n    \"exp_year\": \"{{tk:exp_year}}\",\n    \"cvc\": \"{{tk:cvv}}\"\n  },\n  \"billing_details\": {\n    \"name\": \"Jane Doe\",\n    \"address\": {\n      \"postal_code\": \"94107\"\n    }\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.boltapp.com/v1/tokenizer/proxy")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Bolt-Forward-To"] = '<x-bolt-forward-to>'
request["X-Bolt-Taas-Id"] = '<x-bolt-taas-id>'
request["X-Bolt-Forward-Verb"] = '<x-bolt-forward-verb>'
request["X-API-Key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"type\": \"card\",\n  \"card\": {\n    \"number\": \"{{tk:cc}}\",\n    \"exp_month\": \"{{tk:exp_month}}\",\n    \"exp_year\": \"{{tk:exp_year}}\",\n    \"cvc\": \"{{tk:cvv}}\"\n  },\n  \"billing_details\": {\n    \"name\": \"Jane Doe\",\n    \"address\": {\n      \"postal_code\": \"94107\"\n    }\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "status_code": 200,
  "body": "{\"id\":\"pm_1NQzWT2eZvKYlo2C\",\"object\":\"payment_method\",\"type\":\"card\",\"card\":{\"last4\":\"4242\",\"brand\":\"visa\",\"exp_month\":12,\"exp_year\":2026}}",
  "header": {
    "Content-Type": [
      "application/json"
    ]
  },
  "proxy_operation_id": "PROXY-ABC123-DEF456-GHI789"
}

{
  "error": "Missing required headers (x-bolt-forward-to, x-bolt-taas-id, x-bolt-forward-verb) or invalid JSON body"
}

{
  "error": "Invalid or missing merchant API key"
}

{
  "error": "Invalid x-bolt-taas-id. Credit card not found or expired."
}

{
  "error": "Stripe returned 402 - Card declined"
}

Transactions

Authorize a Card using TaaS

The POST /v1/tokenizer/proxy endpoint allows enterprise merchants to securely authorize transactions with their preferred payment processors (PSPs) by proxying requests through Bolt’s PCI-compliant infrastructure. This API is part of Bolt’s Tokenization-as-a-Service (TaaS) platform, enabling merchants to inject sensitive card data (e.g., PAN, CVV) into PSP-native request formats without directly handling raw card data. The proxy replaces placeholders in the merchant-defined request body with actual card data retrieved securely using the provided x-bolt-taas-id, and forwards the complete request to the specified x-bolt-forward-to URL using the HTTP method specified in x-bolt-forward-verb.

POST

tokenizer

proxy

curl --request POST \
  --url https://api.boltapp.com/v1/tokenizer/proxy \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <api-key>' \
  --header 'X-Bolt-Forward-To: <x-bolt-forward-to>' \
  --header 'X-Bolt-Forward-Verb: <x-bolt-forward-verb>' \
  --header 'X-Bolt-Taas-Id: <x-bolt-taas-id>' \
  --data '
{
  "type": "card",
  "card": {
    "number": "{{tk:cc}}",
    "exp_month": "{{tk:exp_month}}",
    "exp_year": "{{tk:exp_year}}",
    "cvc": "{{tk:cvv}}"
  },
  "billing_details": {
    "name": "Jane Doe",
    "address": {
      "postal_code": "94107"
    }
  }
}
'

import requests

url = "https://api.boltapp.com/v1/tokenizer/proxy"

payload = {
    "type": "card",
    "card": {
        "number": "{{tk:cc}}",
        "exp_month": "{{tk:exp_month}}",
        "exp_year": "{{tk:exp_year}}",
        "cvc": "{{tk:cvv}}"
    },
    "billing_details": {
        "name": "Jane Doe",
        "address": { "postal_code": "94107" }
    }
}
headers = {
    "X-Bolt-Forward-To": "<x-bolt-forward-to>",
    "X-Bolt-Taas-Id": "<x-bolt-taas-id>",
    "X-Bolt-Forward-Verb": "<x-bolt-forward-verb>",
    "X-API-Key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'X-Bolt-Forward-To': '<x-bolt-forward-to>',
    'X-Bolt-Taas-Id': '<x-bolt-taas-id>',
    'X-Bolt-Forward-Verb': '<x-bolt-forward-verb>',
    'X-API-Key': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    type: 'card',
    card: {
      number: '{{tk:cc}}',
      exp_month: '{{tk:exp_month}}',
      exp_year: '{{tk:exp_year}}',
      cvc: '{{tk:cvv}}'
    },
    billing_details: {name: 'Jane Doe', address: {postal_code: '94107'}}
  })
};

fetch('https://api.boltapp.com/v1/tokenizer/proxy', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.boltapp.com/v1/tokenizer/proxy",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'type' => 'card',
    'card' => [
        'number' => '{{tk:cc}}',
        'exp_month' => '{{tk:exp_month}}',
        'exp_year' => '{{tk:exp_year}}',
        'cvc' => '{{tk:cvv}}'
    ],
    'billing_details' => [
        'name' => 'Jane Doe',
        'address' => [
                'postal_code' => '94107'
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-API-Key: <api-key>",
    "X-Bolt-Forward-To: <x-bolt-forward-to>",
    "X-Bolt-Forward-Verb: <x-bolt-forward-verb>",
    "X-Bolt-Taas-Id: <x-bolt-taas-id>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.boltapp.com/v1/tokenizer/proxy"

	payload := strings.NewReader("{\n  \"type\": \"card\",\n  \"card\": {\n    \"number\": \"{{tk:cc}}\",\n    \"exp_month\": \"{{tk:exp_month}}\",\n    \"exp_year\": \"{{tk:exp_year}}\",\n    \"cvc\": \"{{tk:cvv}}\"\n  },\n  \"billing_details\": {\n    \"name\": \"Jane Doe\",\n    \"address\": {\n      \"postal_code\": \"94107\"\n    }\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-Bolt-Forward-To", "<x-bolt-forward-to>")
	req.Header.Add("X-Bolt-Taas-Id", "<x-bolt-taas-id>")
	req.Header.Add("X-Bolt-Forward-Verb", "<x-bolt-forward-verb>")
	req.Header.Add("X-API-Key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.boltapp.com/v1/tokenizer/proxy")
  .header("X-Bolt-Forward-To", "<x-bolt-forward-to>")
  .header("X-Bolt-Taas-Id", "<x-bolt-taas-id>")
  .header("X-Bolt-Forward-Verb", "<x-bolt-forward-verb>")
  .header("X-API-Key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"type\": \"card\",\n  \"card\": {\n    \"number\": \"{{tk:cc}}\",\n    \"exp_month\": \"{{tk:exp_month}}\",\n    \"exp_year\": \"{{tk:exp_year}}\",\n    \"cvc\": \"{{tk:cvv}}\"\n  },\n  \"billing_details\": {\n    \"name\": \"Jane Doe\",\n    \"address\": {\n      \"postal_code\": \"94107\"\n    }\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.boltapp.com/v1/tokenizer/proxy")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Bolt-Forward-To"] = '<x-bolt-forward-to>'
request["X-Bolt-Taas-Id"] = '<x-bolt-taas-id>'
request["X-Bolt-Forward-Verb"] = '<x-bolt-forward-verb>'
request["X-API-Key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"type\": \"card\",\n  \"card\": {\n    \"number\": \"{{tk:cc}}\",\n    \"exp_month\": \"{{tk:exp_month}}\",\n    \"exp_year\": \"{{tk:exp_year}}\",\n    \"cvc\": \"{{tk:cvv}}\"\n  },\n  \"billing_details\": {\n    \"name\": \"Jane Doe\",\n    \"address\": {\n      \"postal_code\": \"94107\"\n    }\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "status_code": 200,
  "body": "{\"id\":\"pm_1NQzWT2eZvKYlo2C\",\"object\":\"payment_method\",\"type\":\"card\",\"card\":{\"last4\":\"4242\",\"brand\":\"visa\",\"exp_month\":12,\"exp_year\":2026}}",
  "header": {
    "Content-Type": [
      "application/json"
    ]
  },
  "proxy_operation_id": "PROXY-ABC123-DEF456-GHI789"
}

{
  "error": "Missing required headers (x-bolt-forward-to, x-bolt-taas-id, x-bolt-forward-verb) or invalid JSON body"
}

{
  "error": "Invalid or missing merchant API key"
}

{
  "error": "Invalid x-bolt-taas-id. Credit card not found or expired."
}

{
  "error": "Stripe returned 402 - Card declined"
}

Authorizations

X-API-Key

string

header

required

Admins and Developers can obtain their Bolt API key from the Bolt Merchant Dashboard.

Headers

X-Bolt-Forward-To

string

required

The fully qualified URL of the payment service provider (PSP) endpoint to which the request should be proxied. This URL must be whitelisted in advance by Bolt.

Example:

"https://api.stripe.com/v1/payment_methods"

X-Bolt-Taas-Id

string

required

Provide your Tokenizer-as-a-Service (TaaS) identifier. This value tells Bolt which stored payment method to use when injecting sensitive data into the proxied request. The value must be in the following format:

bolt_token:{token} - Reference a Bolt-issued short-term token

Merchant-scoped long-term tokens will be supported in a future release. Example usage allows Bolt to securely inject PAN, CVV, and expiration into the forwarded request body.

Example:

"bolt_token:your_bolt_token_here"

X-Bolt-Forward-Verb

enum<string>

required

The HTTP method to use when forwarding the request to the payment service provider (PSP) endpoint. This allows merchants to specify the appropriate HTTP verb for their PSP's API requirements.

Available options:

POST,

PUT,

PATCH

Example:

"POST"

Body

application/json

Use this API to proxy an authorization request to a third-party PSP endpoint using Bolt's secure infrastructure.

Replace raw card fields (e.g., card[number]) with placeholders like {{tk:cc}}, {{tk:cvv}}, {{tk:exp_month}}, etc.
The placeholders will be securely replaced by Bolt using the identifier from x-bolt-taas-id.
The x-bolt-forward-to header must point to a whitelisted PSP URL.
The x-bolt-forward-verb header specifies the HTTP method (POST, PUT, or PATCH) for the PSP request.

Never submit raw PAN, CVV, or expiration directly. Use placeholders. Supported placeholders:

{{tk:cc}} – Full card number
{{tk:cvv}} – Card CVV
{{tk:exp_month}} – Expiration month
{{tk:exp_year}} – Expiration year

The body is of type object.

Response

Successful proxy to the PSP. Returns the PSP's response along with a unique proxy operation ID for tracking.

status_code

integer

HTTP status code returned by the PSP

Example:

200

body

string

Response body from the PSP (JSON string)

Example:

"{\"id\":\"pm_1NQzWT2eZvKYlo2C\",\"object\":\"payment_method\",\"type\":\"card\",\"card\":{\"last4\":\"4242\",\"brand\":\"visa\",\"exp_month\":12,\"exp_year\":2026}}"

header

object

Response headers from the PSP

Show child attributes

Example:

{ "Content-Type": ["application/json"] }

proxy_operation_id

string

Unique identifier for this proxy operation

Example:

"PROXY-ABC123-DEF456-GHI789"

Introduction

Merchant Callback

Merchant Callback reference

Endpoints

Embeddable Checkout v3

Embeddable Checkout v1

Tokenizer

Authorize a Card using TaaS

Authorizations

Headers

Body

Response