> ## Documentation Index
> Fetch the complete documentation index at: https://yn-c9bb3266.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Create One Time Use Token (SDK Checkout)

> Generate a one-time-use token within a checkout session for SDK-based payment flows.

Creates a one-time-use token within an existing checkout session. This is used in the `SDK_CHECKOUT` workflow where card data is collected securely on the client side via the Yuno SDK, then tokenized before being sent to your server for payment creation.

<Info>
  Unlike the [Direct token endpoint](/api-reference/checkout-sessions/create-token-direct), this endpoint does **not** require PCI certification because the Yuno SDK handles card data collection in a secure iframe.
</Info>

## Path Parameters

<ParamField path="checkout_session" type="string" required>
  The checkout session identifier (UUID) returned from [Create Checkout Session](/api-reference/checkout-sessions/create).

  Example: `a1b2c3d4-e5f6-7890-abcd-ef1234567890`
</ParamField>

## Request Body

<ParamField body="account_id" type="string" required>
  The unique identifier of the account. Found in Yuno's Dashboard.

  Constraints: MAX 64; MIN 36
</ParamField>

<ParamField body="card_data" type="object" required>
  Card details to tokenize.

  <Expandable title="card_data">
    <ParamField body="number" type="string" required>
      Card number without separators.

      Constraints: MAX 19; MIN 8

      Example: `4111111111111111`
    </ParamField>

    <ParamField body="expiration_month" type="integer" required>
      Card expiration month in MM format.

      Example: `12`
    </ParamField>

    <ParamField body="expiration_year" type="integer" required>
      Card expiration year in YY or YYYY format.

      Example: `25`
    </ParamField>

    <ParamField body="holder_name" type="string" required>
      Cardholder full name as printed on the card.

      Constraints: MAX 26; MIN 3

      Example: `Dee Hock`
    </ParamField>

    <ParamField body="security_code" type="string">
      Card security code (CVV/CVC).

      Constraints: MAX 4; MIN 2

      Example: `123`
    </ParamField>
  </Expandable>
</ParamField>

<RequestExample>
  ```json Request theme={"theme":{"light":"github-dark","dark":"github-dark"}}
  {
    "account_id": "fe14c7c6-c75e-43b7-bdbe-4c87ad52c482",
    "card_data": {
      "number": "4111111111111111",
      "expiration_month": 12,
      "expiration_year": 25,
      "security_code": "123",
      "holder_name": "Dee Hock"
    }
  }
  ```
</RequestExample>

<ResponseExample>
  ```json 201 theme={"theme":{"light":"github-dark","dark":"github-dark"}}
  {
    "token": "dab106a6-9067-4418-ae43-6045663531dc",
    "type": "CARD",
    "card_data": {
      "holder_name": "Dee Hock",
      "iin": "41111111",
      "lfd": "1111",
      "brand": "VISA",
      "type": "DEBIT"
    },
    "country": "US"
  }
  ```
</ResponseExample>

## Response Fields

<ResponseField name="token" type="string">
  The one-time-use token. Use this in the [Create Payment](/api-reference/payments/create) request as `payment_method.token`.
</ResponseField>

<ResponseField name="vaulted_token" type="string">
  Stored payment method token, returned when the card was previously enrolled.
</ResponseField>

<ResponseField name="vault_on_success" type="boolean">
  Whether the card will be vaulted upon successful payment. Default: `true`.
</ResponseField>

<ResponseField name="type" type="string">
  Payment method type.

  Example: `CARD`
</ResponseField>

<ResponseField name="card_data" type="object">
  Tokenized card metadata (no sensitive data).

  <Expandable title="card_data">
    <ResponseField name="holder_name" type="string">
      Cardholder name.
    </ResponseField>

    <ResponseField name="iin" type="string">
      Issuer Identification Number (first 6-8 digits).
    </ResponseField>

    <ResponseField name="lfd" type="string">
      Last four digits of the card.
    </ResponseField>

    <ResponseField name="number_length" type="integer">
      Total length of the card number.
    </ResponseField>

    <ResponseField name="security_code_length" type="integer">
      Length of the security code.
    </ResponseField>

    <ResponseField name="brand" type="string">
      Card brand (e.g., `VISA`, `MASTERCARD`).
    </ResponseField>

    <ResponseField name="type" type="string">
      Card type: `CREDIT`, `DEBIT`, or `PREPAID`.
    </ResponseField>

    <ResponseField name="category" type="string">
      Card category (e.g., `Gold`, `Platinum`).
    </ResponseField>

    <ResponseField name="issuer_name" type="string">
      Name of the issuing bank.
    </ResponseField>

    <ResponseField name="country_code" type="string">
      Card issuer country (ISO 3166-1 alpha-2).
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="country" type="string">
  ISO 3166-1 alpha-2 country code.
</ResponseField>

## Error Responses

| Status | Description                                         |
| ------ | --------------------------------------------------- |
| `400`  | Invalid request parameters. Check card\_data fields |
| `401`  | Invalid credentials. Verify API keys                |
| `403`  | Merchant not authorized for this API                |

## Related Pages

* [Create One Time Use Token (Direct)](/api-reference/checkout-sessions/create-token-direct). Token generation for PCI-compliant merchants
* [Create Checkout Session](/api-reference/checkout-sessions/create). Create the session first
* [Create Payment](/api-reference/payments/create). Use the token to create a payment
* [SDK Full Checkout](/guides/sdk/full-checkout). End-to-end SDK checkout guide