Developers
REST API
GuidesErrorsLogin
Get API Keys
API Navigation
  • Overview
  • Quick start
  • Authentication
  • Collect a payment
  • Payment status
  • Refunds
  • Testing
  • Production
  • Security
API reference
  • Create API keys POST
  • List API keys GET
  • Get API key GET
  • Delete API key DEL
  • Collect with MTN POST
  • MTN payment status GET
  • Collect with Airtel POST
    Create and pay
  • Create order POST
  • Order fee POST
  • Pay order with card POST
  • Pay order with bank POST
    • Status and verify
  • Order status POST
  • Verify order POST
    • Cards and tokens
  • Save card POST
  • Tokenize charge GET
    • Refunds
  • Refund order POST
    • Lists and stats
  • List orders GET
  • Get order GET
  • List banks GET
  • Order stats GET
  • List transactions GET
  • Get transaction GET
  • Transaction statuses GET
Errors and limits
  1. Docs
  3. API reference
  5. Save card

Save card

Ask TransactPay to save the card used for an order reference.

OpenAPI SpecRun in Postman
POST/payment/zibapay/order/save-card/:referenceAPI
Authentication:Bearer token•Authorization: Bearer <token>(Bearer token for server-to-server API calls)
Security requirement: 403 CSRF Protection
Auth guide →

Direct server-to-server calls authenticated via Bearer tokens do not require CSRF headers. If you instead invoke mutation endpoints from a web browser using cookie-based sessions, you must include the following header:

X-Requested-With: XMLHttpRequest

Path params

FieldTypeRequiredDescription
referencestringRequiredtransactionReferenceId from the collect response, or the order reference.
import axios from "axios";

const url = "https://payment-service-mh2d.onrender.com/api/payment/zibapay/order/save-card/:reference";

const headers = {
    Authorization: `Bearer ${process.env.ZIBA_TOKEN}`,
};

try {
  const response = await axios.post(url, {
    headers,
    timeout: 15000,
  });
  console.log("Success:", response.status, response.data);
} catch (error) {
  console.error("Request failed:", error.response?.data || error.message);
}
Auth guide

Response fields

FieldTypePresenceDescription
cardTokenstringAlways returnedReusable authorization token for recurring or one-click billing.
last4stringAlways returnedLast four digits of the saved payment card.
brandstringAlways returnedCard network brand (e.g. Visa, Mastercard).
expirymonthstringAlways returnedCard expiration month.
expiryyearstringAlways returnedCard expiration year.

Status codes

HTTP StatusMeaning
200Card saved and token generated.
401No merchant session.

Notes

  • No request body. HTTP 200 returns the saved card token representation.
Was this page helpful?

Let us know how we can make our API documentation better.

PreviousVerify order
NextTokenize charge