Card Vaulting Guide — EPD Commerce

Save a card once and charge it again. The card is captured in a secure field, tokenized, and stored in EPD's PCI-scoped vault; raw card data never touches your servers or EPD's API.

The recommended way to capture a card is EPD Elements, the epd.js browser SDK. No browser in the loop (phone/MOTO orders, back-office tools, migrations)? Use Inbound Card Capture. Both produce the same vaulted payment method.

Two keys

Key	Where it runs	What it does
Publishable `epd_..._pk_...`	Browser	Capture-only: tokenizes a card and nothing else. Safe to ship client-side.
Secret `epd_..._sk_...`	Server	Attaches the captured card to a customer, then charges it. Never expose it.

EPD's API does not accept raw PAN, CVV, or expiry. Card data only ever reaches EPD through the secure capture field.

Integration Flow

Capture the card Client-side Your checkout page loads epd.js and mounts a secure card field with your publishable key. The shopper enters their card; your pages and servers never see the raw PAN.
Tokenize Client-side On submit, the SDK returns a single-use card_token (cct_...).
Send the token to your backend Client-side → your server Your frontend POSTs the card_token to your own server.
Attach to a customer Server-side → EPD Your backend attaches the token with your secret key → Add Payment Method. EPD vaults the card and returns a payment_method_id.
Charge Server-side → EPD Pass payment_method_id when creating an order or subscription. The card never has to be entered again.

A card_token is single-use and expires 15 minutes after capture. Attach it promptly; if the attach fails, capture a fresh one; never resend a spent token.

Key Identifiers

Identifier	Source	Lifetime	Description
`card_token` (`cct_...`)	EPD Elements	15 minutes	One-time, single-use token representing the captured card
`payment_method_id` (UUID)	EPD	Permanent	The vaulted payment method on an EPD customer

After Vaulting

Once the card is stored, you can use the payment_method for:

One-time charges: pass payment_method_id when creating an order
Recurring billing: pass payment_method_id when creating a subscription
Default payment method: update the customer to change their default card
Adding more cards: capture each card with EPD Elements and add it with its own card_token

Security

Never log, store, or transmit raw card numbers. Capture cards only through the EPD Elements secure field; never build your own input that touches the PAN.

Keep your secret key server-side only; never ship it to the browser. Only the publishable key belongs in client code.
Use HTTPS for all API calls.
Rotate keys periodically from the EPD Commerce dashboard.