Developers
REST API
GuidesErrorsLogin
Get API Keys
API Navigation
  • Overview
  • Quick start
  • Authentication
  • Collect a payment
  • Payment status
  • Refunds
  • Testing
  • Production
  • Security
API reference
  • Create API keys POST
  • List API keys GET
  • Get API key GET
  • Delete API key DEL
  • Collect with MTN POST
  • MTN payment status GET
  • Collect with Airtel POST
    Create and pay
  • Create order POST
  • Order fee POST
  • Pay order with card POST
  • Pay order with bank POST
    • Status and verify
  • Order status POST
  • Verify order POST
    • Cards and tokens
  • Save card POST
  • Tokenize charge GET
    • Refunds
  • Refund order POST
    • Lists and stats
  • List orders GET
  • Get order GET
  • List banks GET
  • Order stats GET
  • List transactions GET
  • Get transaction GET
  • Transaction statuses GET
Errors and limits
  1. Docs
  3. API reference
  5. Tokenize charge

Tokenize charge

Charge a saved card token. The route is GET and still reads a JSON body.

OpenAPI SpecRun in Postman
GET/payment/zibapay/card/tokenize/:referenceAPI
Authentication:Bearer token•Authorization: Bearer <token>(Bearer token for server-to-server API calls)
Security requirement: 403 CSRF Protection
Auth guide →

Direct server-to-server calls authenticated via Bearer tokens do not require CSRF headers. If you instead invoke mutation endpoints from a web browser using cookie-based sessions, you must include the following header:

X-Requested-With: XMLHttpRequest

Request Parameters

FieldTypeRequiredDescription
referencestringRequiredtransactionReferenceId from the collect response, or the order reference.
import axios from "axios";

const url = "https://payment-service-mh2d.onrender.com/api/payment/zibapay/card/tokenize/:reference";

const headers = {
    Authorization: `Bearer ${process.env.ZIBA_TOKEN}`,
};

try {
  const response = await axios.get(url, {
    headers,
    timeout: 15000,
  });
  console.log("Success:", response.status, response.data);
} catch (error) {
  console.error("Request failed:", error.response?.data || error.message);
}
Auth guide

Response fields

FieldTypePresenceDescription
statusstringAlways returnedPayment status: COMPLETED or PENDING.
referencestringAlways returnedOrder reference charged.
transactionIdstringAlways returnedTransactPay transaction identifier.
amountnumberAlways returnedAmount charged to saved card.
currencystringAlways returnedCurrency code.

Status codes

HTTP StatusMeaning
200Tokenized payment charged.
401No merchant session.

Notes

  • The registered method is GET. Clients that cannot send a body on GET should not assume a POST alias exists.
Was this page helpful?

Let us know how we can make our API documentation better.

PreviousSave card
NextRefund order