Tokens

Tokenization in Yuno: one time tokens from the SDK, vaulted tokens for returning customers, and how to list and delete stored methods.

Tokenization replaces sensitive payment data (card numbers, bank account details) with a non sensitive token. Your server uses the token in API calls without ever handling the raw data, which keeps you out of PCI scope and lets you reuse methods for one click checkout.

One time token

A one time token represents a single payment method submission. The Yuno SDK generates it when the customer enters their method data, and it is valid for one payment only.

Property	Value
Created by	Yuno SDK on the client
Validity	Single use, expires after the payment or a timeout
PCI scope	None, the SDK handles sensitive data
Use case	Standard checkout, guest payments

// The SDK produces a one time token when the customer submits their method
yuno.mountCheckout({
  checkoutSession: 'cs_abc123',
  onTokenize: (token) => {
    // Send token.one_time_token to your server for the payment
    createPayment(token.one_time_token);
  }
});

Vaulted token

A vaulted token stores a method for reuse, bound to a customer profile. Use vaulted tokens for returning customers, one click checkout, and subscriptions.

Property	Value
Created by	Yuno, when you pass vaulted_token: true on payment creation
Validity	Persistent until deleted or expired
PCI scope	None, Yuno stores the sensitive data
Use case	Returning customers, one click checkout, subscriptions

Vault a method during a payment:

{
  "checkout_session": "cs_abc123",
  "payment_method": { "type": "CARD", "token": "tok_from-the-sdk" },
  "customer": { "customer_id": "cust_456" },
  "vaulted_token": true
}

The customer must have a Yuno customer profile before you can vault a token. Create one through Create customer first.

When to use each

Scenario	Token	Why
Guest checkout	One time	No customer relationship needed
Returning customer	Vaulted	Skip method entry, one click pay
Subscription billing	Vaulted	Charge without the customer present
Direct API, PCI certified	None, raw data	Only for certified merchants handling cards themselves

Vaulted tokens are bound to a specific customer and cannot be transferred. If the customer wants to use a different card, vault a new token against the same customer_id.

List vaulted methods

Returns every vaulted method for a customer.

curl --request GET \
  --url https://api-sandbox.y.uno/v1/customers/{customer_id}/payment-methods \
  --header 'public-api-key: your-public-api-key' \
  --header 'private-secret-key: your-private-secret-key' \

See List payment methods and the Payment method object.

Delete a vaulted token

curl --request DELETE \
  --url https://api-sandbox.y.uno/v1/customers/{customer_id}/payment-methods/{token_id} \
  --header 'public-api-key: your-public-api-key' \
  --header 'private-secret-key: your-private-secret-key' \

See Unenroll payment method.

What next

Payment methods

Method availability and per method requirements.

Customers

Profiles that own vaulted tokens.

Network tokens

Replace raw PANs with network tokens for higher approval.

Stored credentials

CIT, MIT, and subscription style recurring billing.