Generate Network Token Cryptogram

POST

network-tokens

cryptograms

curl --request POST \
  --url https://api-sandbox.y.uno/v1/network-tokens/cryptograms \
  --header 'Content-Type: application/json' \
  --header 'private-secret-key: <api-key>' \
  --header 'public-api-key: <api-key>' \
  --data '
{
  "vaulted_token": "9b2f4b1c-7f3a-4c2e-9b1a-2b3c4d5e6f70",
  "country": "US",
  "amount": {
    "currency": "USD",
    "value": 49.99
  }
}
'

import requests

url = "https://api-sandbox.y.uno/v1/network-tokens/cryptograms"

payload = {
    "vaulted_token": "9b2f4b1c-7f3a-4c2e-9b1a-2b3c4d5e6f70",
    "country": "US",
    "amount": {
        "currency": "USD",
        "value": 49.99
    }
}
headers = {
    "public-api-key": "<api-key>",
    "private-secret-key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'public-api-key': '<api-key>',
    'private-secret-key': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    vaulted_token: '9b2f4b1c-7f3a-4c2e-9b1a-2b3c4d5e6f70',
    country: 'US',
    amount: {currency: 'USD', value: 49.99}
  })
};

fetch('https://api-sandbox.y.uno/v1/network-tokens/cryptograms', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api-sandbox.y.uno/v1/network-tokens/cryptograms",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'vaulted_token' => '9b2f4b1c-7f3a-4c2e-9b1a-2b3c4d5e6f70',
    'country' => 'US',
    'amount' => [
        'currency' => 'USD',
        'value' => 49.99
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "private-secret-key: <api-key>",
    "public-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api-sandbox.y.uno/v1/network-tokens/cryptograms"

	payload := strings.NewReader("{\n  \"vaulted_token\": \"9b2f4b1c-7f3a-4c2e-9b1a-2b3c4d5e6f70\",\n  \"country\": \"US\",\n  \"amount\": {\n    \"currency\": \"USD\",\n    \"value\": 49.99\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("public-api-key", "<api-key>")
	req.Header.Add("private-secret-key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api-sandbox.y.uno/v1/network-tokens/cryptograms")
  .header("public-api-key", "<api-key>")
  .header("private-secret-key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"vaulted_token\": \"9b2f4b1c-7f3a-4c2e-9b1a-2b3c4d5e6f70\",\n  \"country\": \"US\",\n  \"amount\": {\n    \"currency\": \"USD\",\n    \"value\": 49.99\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api-sandbox.y.uno/v1/network-tokens/cryptograms")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["public-api-key"] = '<api-key>'
request["private-secret-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"vaulted_token\": \"9b2f4b1c-7f3a-4c2e-9b1a-2b3c4d5e6f70\",\n  \"country\": \"US\",\n  \"amount\": {\n    \"currency\": \"USD\",\n    \"value\": 49.99\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "vaulted_token": "9b2f4b1c-7f3a-4c2e-9b1a-2b3c4d5e6f70",
  "network_token": {
    "network": "VISA",
    "number": "4111111111111111",
    "status": "ACTIVE",
    "par": "V0010013022280191",
    "network_token_id": "DNITHE302344816910968",
    "token_data": {
      "iin": "411111",
      "lfd": "1111",
      "expiration_month": 7,
      "expiration_year": 2029
    }
  },
  "cryptogram": "AgAAAAAABk4DWZ4C28yUQAAAAAA=",
  "eci": "05",
  "created_at": "2026-07-16T14:32:10Z"
}

{
  "code": "NETWORK_TOKEN_NOT_FOUND",
  "messages": [
    "Payment method has no network token."
  ]
}

{
  "code": "PCI_MERCHANT_REQUIRED",
  "messages": [
    "This endpoint is only available to PCI-certified merchants."
  ]
}

{
  "code": "PAYMENT_METHOD_NOT_FOUND",
  "messages": [
    "Payment method not found."
  ]
}

{
  "code": "PROVIDER_ERROR",
  "messages": [
    "The network token cryptogram service is temporarily unavailable, please retry."
  ]
}

This endpoint returns an on-demand network token cryptogram for a vaulted card, together with the card’s current network token (DPAN). A card’s network token alone cannot authorize a payment — card schemes require a single-use cryptogram per transaction, and only Yuno can request it because Yuno holds the Token Requestor ID. Use this endpoint when you want to take a Yuno network token and authorize the transaction on your own PSP. You identify the card with its vaulted_token — the same identifier you use in Create Payment. Yuno resolves the card’s current network token internally and absorbs token rotation, so you always receive a consistent, current (DPAN, cryptogram, ECI) set.

PCI merchants onlyThis endpoint is only available for PCI-certified merchants, because the response contains the full network token (DPAN). To enable it, contact your Key Account Manager (KAM).

Always submit the returned pair. A cryptogram is bound to a specific network token. Submit the network_token.number (DPAN) returned in the same response together with its cryptogram and eci. Never pair a returned cryptogram with a previously stored DPAN — after a token rotation, a stored DPAN will no longer match.

How it works

Request a cryptogram right before you authorize. Every call generates a fresh, single-use cryptogram from the scheme — there is no idempotency, and duplicate calls simply return new cryptograms (no money moves).
Submit network_token.number (DPAN), cryptogram, and eci to your PSP as a network-token transaction.
If the authorization is declined and you retry, request a new cryptogram first — a used or stale cryptogram cannot be replayed.

Requirements

To use this endpoint your organization must:

Be a PCI-certified merchant (the response contains the DPAN).
Have the product enabled for your organization.
Be onboarded for network tokens for the card’s brand and the requested country.

The card referenced by vaulted_token must be an enrolled card of your organization that already has an active network token. Supported networks: Visa and Mastercard.

When you don’t need this endpoint. Recurring merchant-initiated transactions (MIT) authorize with the network token and the stored network_transaction_id and do not require a cryptogram. This endpoint is for customer-initiated transactions that need a fresh cryptogram.

Cryptogram lifetime

The cryptogram is single-use — request it immediately before you authorize, and do not cache it.

Errors

Errors return a code and a messages array. The exact messages value per code:

HTTP	`code`	`messages`
404	`PAYMENT_METHOD_NOT_FOUND`	”Payment method not found.”
400	`INSTRUMENT_NOT_TOKENIZABLE`	”Payment method is not a card.”
400	`PAYMENT_METHOD_NOT_ENROLLED`	”Payment method is not enrolled.”
400	`NETWORK_TOKEN_NOT_FOUND`	”Payment method has no network token.”
400	`TOKEN_NOT_ACTIVE`	”Network token is not active.”
400	`NETWORK_NOT_SUPPORTED`	”Network token brand is not supported.”
400	`COUNTRY_NOT_SUPPORTED`	”Country is not supported for this organization.”
400	`INVALID_REQUEST`	The specific invalid field, e.g. “The field ‘vaulted_token’ must be a valid uuid v4.”
403	`PCI_MERCHANT_REQUIRED`	”This endpoint is only available to PCI-certified merchants.”
403	`PRODUCT_NOT_ENABLED`	”The Network Token Cryptogram API is enabled per organization. Contact your Key Account Manager (KAM) to activate it.”
502	`PROVIDER_ERROR`	”The network token cryptogram service is temporarily unavailable, please retry.”

A vaulted_token that doesn’t exist and one that belongs to another organization both return the same PAYMENT_METHOD_NOT_FOUND — no existence leak.

Authorizations

public-api-key

string

header

default:<Your public-api-key>

required

private-secret-key

string

header

default:<Your private-secret-key>

required

Body

application/json

vaulted_token

string<uuid>

required

The vaulted token of the card, the same identifier used as payment_method.vaulted_token in Create Payment. The card must be an enrolled card of your organization with an active network token.

Example:

"9b2f4b1c-7f3a-4c2e-9b1a-2b3c4d5e6f70"

country

string

required

ISO 3166-1 alpha-2 country code where the token will be used. Resolves the network token onboarding (organization + brand + country), with the same semantics as country in Create Payment.

Example:

"US"

amount

object

Optional. Forwarded to the scheme; recommended, as some scheme flows bind the amount.

Show child attributes

Response

Cryptogram generated.

vaulted_token

string

Echo of the request's vaulted token.

network_token

object

The card's current network token. Same shape returned by the PCI network-token retrieval.

Show child attributes

cryptogram

string

A fresh, single-use cryptogram from the scheme, generated on every call. Submit it together with network_token.number (DPAN) and eci to your PSP.

Example:

"AgAAAAAABk4DWZ4C28yUQAAAAAA="

eci

string | null

Electronic Commerce Indicator. May be null for some Mastercard DSRP formats.

Example:

"05"

created_at

string<date-time>

Issuance timestamp (UTC).

Enrollment StatusLists the possible statuses a payment method can have during the enrollment process

⌘I

Generate Network Token Cryptogram

curl --request POST \
  --url https://api-sandbox.y.uno/v1/network-tokens/cryptograms \
  --header 'Content-Type: application/json' \
  --header 'private-secret-key: <api-key>' \
  --header 'public-api-key: <api-key>' \
  --data '
{
  "vaulted_token": "9b2f4b1c-7f3a-4c2e-9b1a-2b3c4d5e6f70",
  "country": "US",
  "amount": {
    "currency": "USD",
    "value": 49.99
  }
}
'

import requests

url = "https://api-sandbox.y.uno/v1/network-tokens/cryptograms"

payload = {
    "vaulted_token": "9b2f4b1c-7f3a-4c2e-9b1a-2b3c4d5e6f70",
    "country": "US",
    "amount": {
        "currency": "USD",
        "value": 49.99
    }
}
headers = {
    "public-api-key": "<api-key>",
    "private-secret-key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'public-api-key': '<api-key>',
    'private-secret-key': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    vaulted_token: '9b2f4b1c-7f3a-4c2e-9b1a-2b3c4d5e6f70',
    country: 'US',
    amount: {currency: 'USD', value: 49.99}
  })
};

fetch('https://api-sandbox.y.uno/v1/network-tokens/cryptograms', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api-sandbox.y.uno/v1/network-tokens/cryptograms",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'vaulted_token' => '9b2f4b1c-7f3a-4c2e-9b1a-2b3c4d5e6f70',
    'country' => 'US',
    'amount' => [
        'currency' => 'USD',
        'value' => 49.99
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "private-secret-key: <api-key>",
    "public-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api-sandbox.y.uno/v1/network-tokens/cryptograms"

	payload := strings.NewReader("{\n  \"vaulted_token\": \"9b2f4b1c-7f3a-4c2e-9b1a-2b3c4d5e6f70\",\n  \"country\": \"US\",\n  \"amount\": {\n    \"currency\": \"USD\",\n    \"value\": 49.99\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("public-api-key", "<api-key>")
	req.Header.Add("private-secret-key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api-sandbox.y.uno/v1/network-tokens/cryptograms")
  .header("public-api-key", "<api-key>")
  .header("private-secret-key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"vaulted_token\": \"9b2f4b1c-7f3a-4c2e-9b1a-2b3c4d5e6f70\",\n  \"country\": \"US\",\n  \"amount\": {\n    \"currency\": \"USD\",\n    \"value\": 49.99\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api-sandbox.y.uno/v1/network-tokens/cryptograms")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["public-api-key"] = '<api-key>'
request["private-secret-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"vaulted_token\": \"9b2f4b1c-7f3a-4c2e-9b1a-2b3c4d5e6f70\",\n  \"country\": \"US\",\n  \"amount\": {\n    \"currency\": \"USD\",\n    \"value\": 49.99\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "vaulted_token": "9b2f4b1c-7f3a-4c2e-9b1a-2b3c4d5e6f70",
  "network_token": {
    "network": "VISA",
    "number": "4111111111111111",
    "status": "ACTIVE",
    "par": "V0010013022280191",
    "network_token_id": "DNITHE302344816910968",
    "token_data": {
      "iin": "411111",
      "lfd": "1111",
      "expiration_month": 7,
      "expiration_year": 2029
    }
  },
  "cryptogram": "AgAAAAAABk4DWZ4C28yUQAAAAAA=",
  "eci": "05",
  "created_at": "2026-07-16T14:32:10Z"
}

{
  "code": "NETWORK_TOKEN_NOT_FOUND",
  "messages": [
    "Payment method has no network token."
  ]
}

{
  "code": "PCI_MERCHANT_REQUIRED",
  "messages": [
    "This endpoint is only available to PCI-certified merchants."
  ]
}

{
  "code": "PAYMENT_METHOD_NOT_FOUND",
  "messages": [
    "Payment method not found."
  ]
}

{
  "code": "PROVIDER_ERROR",
  "messages": [
    "The network token cryptogram service is temporarily unavailable, please retry."
  ]
}

Getting Started

Reference

Customers

Network Tokens

Customer Sessions (Enrollment)

Checkout Sessions

Payment Methods (Checkout)

Checkout Builder

Payment Methods (Direct Workflow)

PCI Proxy

Payments

Pre-Debit Notifications

3DS2 Setup

Unreferenced Refunds

Dry-run

Payment Links

Recipients for Marketplace

Sellers (Franchise)

Subscriptions

Payouts

Organizations

Reports

Installments

AI Caller

Communications Campaigns

Conversion Rate

Banking Connectivity

Webhooks

How it works

Requirements

Cryptogram lifetime

Errors

Authorizations

Body

Response

​How it works

​Requirements

​Cryptogram lifetime

​Errors

Authorizations

Body

Response

How it works

Requirements

Cryptogram lifetime

Errors