Retrieve Secure Card Numbers

Mint a credential for a specific amount and merchant from an order intent. Choose one rail from the order-intent response and use that same rail for verification and credential minting.

Prerequisites

Verified order intent — follow Create an Agent Card and wait for a rail with status: "active".
Crossmint API key — a client-side key with order-intents.read and order-intents.credentials scopes. In staging, all scopes are included by default.
User JWT — use the JWT for the user who owns the order intent.

Mint a Credential

Find the rail you want to use and confirm that it is active and supports card credentials. Other rails can remain pending. Send the selected rail’s rail and provider values back in the request. This example continues from the merchant-scoped order intent created in the previous guide, so the credential request does not repeat the merchant:

const CROSSMINT_CLIENT_API_KEY = "YOUR_CROSSMINT_CLIENT_API_KEY";
const jwt = "YOUR_USER_JWT";
const orderIntentId = "a1b2c3d4-e5f6-4890-abcd-ef1234567890";

const orderIntentResponse = await fetch(
    `https://staging.crossmint.com/api/unstable/order-intents/${orderIntentId}`,
    {
        headers: {
            "X-API-KEY": CROSSMINT_CLIENT_API_KEY,
            Authorization: `Bearer ${jwt}`,
        },
    }
);

if (!orderIntentResponse.ok) {
    throw new Error(`Order intent retrieval failed (${orderIntentResponse.status})`);
}

const orderIntent = await orderIntentResponse.json();

const selectedRail = orderIntent.rails.find(
    (rail) => rail.status === "active" && rail.credentialFormats.includes("card")
);

if (selectedRail == null) {
    throw new Error("No active rail supports card credentials");
}

const response = await fetch(
    `https://staging.crossmint.com/api/unstable/order-intents/${orderIntent.orderIntentId}/credentials`,
    {
        method: "POST",
        headers: {
            "Content-Type": "application/json",
            "X-API-KEY": CROSSMINT_CLIENT_API_KEY,
            Authorization: `Bearer ${jwt}`,
        },
        body: JSON.stringify({
            rail: selectedRail.rail,
            provider: selectedRail.provider,
            amount: { value: "25.00", currency: orderIntent.amount.currency },
            credential: { format: "card" },
        }),
    }
);

if (!response.ok) {
    throw new Error(`Credential creation failed (${response.status})`);
}

const result = await response.json();

Open Order Intents

If orderIntent.merchant is absent, include a merchant in every credential request:

merchant: {
    name: "Acme Store",
    url: "https://acme.example.com",
    countryCode: "US",
},

The response returns the selected rail and the credential value. An inactive status on another rail does not affect this request:

{
    "id": "cred_123",
    "rail": "agentic-token",
    "provider": "vic",
    "amount": { "value": "25.00", "currency": "USD" },
    "credential": {
        "format": "card",
        "value": {
            "number": "4000001000004242",
            "expirationMonth": 12,
            "expirationYear": 2030,
            "cvc": "123"
        }
    },
    "expiresAt": "2099-01-01T00:05:00.000Z"
}

Treat the credential as a secret. Use it immediately, never log it, and do not persist it for later reuse. Minting deducts the requested amount from the order intent even if the credential is never used. For the complete schema, see the Create Order Intent Credential API Reference.

List Order Intents

List every order intent owned by the authenticated user:

const CROSSMINT_CLIENT_API_KEY = "YOUR_CROSSMINT_CLIENT_API_KEY";
const jwt = "YOUR_USER_JWT";

const response = await fetch("https://staging.crossmint.com/api/unstable/order-intents", {
    headers: {
        "X-API-KEY": CROSSMINT_CLIENT_API_KEY,
        Authorization: `Bearer ${jwt}`,
    },
});

if (!response.ok) {
    throw new Error(`Order intent listing failed (${response.status})`);
}

const orderIntents = await response.json();

Each item includes its live balance and rails. Use GET /api/unstable/order-intents/{orderIntentId} when you only need to refresh one order intent.

Common Gotchas

The request amount must fit the available balance

Use the same currency as the order intent and keep the requested value at or below amount.available.

Creating a credential spends allowance capacity

Do not retry a credential request blindly. Each successful mint is a new credential and consumes the requested amount.

A pending rail cannot mint credentials

Complete allowance verification for the rail you selected and fetch the order intent again before minting. You do not need to verify unrelated rails.

Open order intents require a merchant

If the order intent was created without merchant, include one in every credential request. If the merchant was set at creation, omit it when minting.

Agents

Quickstarts ⚡

Payment Methods

Payment Flows

API Reference

Retrieve Secure Card Numbers

Prerequisites

Mint a Credential

Open Order Intents

List Order Intents

Common Gotchas

Next Steps

Cancel Card Access

Cards Quickstart

​Prerequisites

​Mint a Credential

​Open Order Intents

​List Order Intents

​Common Gotchas

​Next Steps

Cancel Card Access

Cards Quickstart

Prerequisites

Mint a Credential

Open Order Intents

List Order Intents

Common Gotchas

Next Steps