The product
The four vaults
Credit card tokenization API
Card Vault is a credit card tokenization API with a payment gateway proxy. It tokenizes payment cards the moment they are captured and charges them through the payment gateway you already use. One way in, and no way out except through the proxy. Your PCI scope collapses to nearly nothing, and your gateway choice stays yours.
The problem
Every server the data touches, every database it lands in, every backup it survives in. And your processor’s own vault solves the storage problem while creating a new one, because your card data is now locked inside one vendor.
Card Vault removes both problems at once. Cards never touch your systems, and charges route to any gateway you choose.
Free tier
Your first 1,000 requests a month are free. No need to talk to anyone.
Capture
Drop a hosted card capture form into any website or checkout flow with an iframe embed. It embeds in any checkout, including Magento and WooCommerce storefronts, and keeps you out of PCI scope entirely.
Tokenize cards captured through Twilio’s IVR connector. Cards flow directly from phone calls into your Card Vault, encrypted and tokenized, without touching your servers or your agents’ screens.
For server-side flows you control, the REST API tokenizes cards in a single call, with OAuth2 machine-to-machine authentication and full audit logging on every request.
Tokens
Engineered so your existing systems keep working.
Optional format-preserving tokens can pass card number validation, so checkout code, fraud rules, and legacy systems that expect a valid-looking card number never notice the difference.
The same card can always map to the same token, preserving customer-level lookups, deduplication, and card-on-file logic.
Random tokens by default, with no structure to reverse. Optional format-preserving tokens keep the first six and last four digits so existing checkout validation keeps working, or can be issued from your own BIN range.
Held encrypted for at most 30 minutes, then deleted, which is exactly what your assessor wants to hear.
Integration
Two calls to a token. The docs and Swagger UI are live right now.
The proxy
The payment proxy sends charges to your gateway with real card data substituted inside the vault, so raw values never touch your servers.
Authorize.net, Stripe, Braintree, PayPal, and any REST-based payment gateway. Switching processors later is a configuration change, not a migration.
Proxy requests can be signed (HMAC-SHA256, or OAuth 1.0a RSA-SHA256 for Mastercard) and restricted to an allowlist of gateway domains. Custom headers and HTTP methods are supported.
Placeholders for card number, CVV, and expiry are replaced with real values inside the vault. The CVV is held encrypted for at most 30 minutes, then deleted.
Who uses it
Wherever a card has to be stored, charged again, or taken over the phone, custody is the part you can hand off.
Tokenize once, charge on schedule, and let deterministic tokens keep your customer records coherent.
Offer payments to your merchants while the vault carries the custody and your codebase stays out of PCI scope.
Capture cards by phone through Twilio Pay without agents ever hearing or seeing a number.
Embedded forms that fit any checkout, including Magento and WooCommerce storefronts, tokenizing in one step.
