> ## Documentation Index
> Fetch the complete documentation index at: https://developer.finogates.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Mint an In-Iframe Card-Connect Session

> Returns a short-lived embed token the platform loads in a Finogate iframe to render a fully-custom card form (an alternative to the redirect-based `/connect`). The card is tokenised in-browser and submitted straight to the processor — PAN never reaches your servers. Requires active AFT or OCT capability. Pass the end-user's real IP and (for users without completed KYC) their DOB + contact/address.



## OpenAPI

````yaml POST /v1/platform/payment-methods/cards/connect/embedded
openapi: 3.1.0
info:
  title: Finogate Platform API v1
  version: 0.1.0
servers:
  - url: https://api-sandbox.finogates.com
    description: Sandbox
  - url: https://api.finogates.com
    description: Production
security: []
tags:
  - name: auth
  - name: users
  - name: payees
  - name: verification
  - name: bank accounts
  - name: card processing
  - name: digital-assets
  - name: international
  - name: fees
  - name: onboarding
  - name: pending-applications
  - name: wallets
  - name: payments
  - name: document mailing
  - name: merchant onboarding
  - name: catalog
  - name: webhooks
  - name: screening
  - name: Platform - File Scanning
  - name: phone-numbers
  - name: sms
  - name: calls
  - name: listings
  - name: Card Transfers
  - name: embed-tokens
paths:
  /v1/platform/payment-methods/cards/connect/embedded:
    post:
      tags:
        - Card Transfers
      summary: Mint an in-iframe card-connect session
      description: >-
        Returns a short-lived embed token the platform loads in a Finogate
        iframe to render a fully-custom card form (an alternative to the
        redirect-based `/connect`). The card is tokenised in-browser and
        submitted straight to the processor — PAN never reaches your servers.
        Requires active AFT or OCT capability. Pass the end-user's real IP and
        (for users without completed KYC) their DOB + contact/address.
      operationId: >-
        connect_card_embedded_v1_platform_payment_methods_cards_connect_embedded_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EmbeddedCardConnectCreate'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CommonResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - _AuthenticatedBearer: []
components:
  schemas:
    EmbeddedCardConnectCreate:
      properties:
        user_id:
          type: string
          format: uuid
          title: User Id
        entity_type:
          type: string
          enum:
            - personal
            - business
          title: Entity Type
          description: >-
            Onboarding track for this user: `personal` (individual, KYC) or
            `business` (merchant/company, KYB ~24-48h review). Defaults to
            `personal`.
          default: personal
        parent_origin:
          type: string
          maxLength: 255
          title: Parent Origin
          description: >-
            Origin of the page embedding the iframe (e.g.
            https://app.example.com). Used as the postMessage targetOrigin.
        ip_address:
          anyOf:
            - type: string
              maxLength: 45
              minLength: 3
            - type: 'null'
          title: Ip Address
        date_of_birth:
          anyOf:
            - type: string
            - type: 'null'
          title: Date Of Birth
          description: End-user DOB (YYYY-MM-DD). Required if the user has no KYC.
        phone:
          anyOf:
            - type: string
              maxLength: 32
            - type: 'null'
          title: Phone
        address1:
          anyOf:
            - type: string
              maxLength: 255
            - type: 'null'
          title: Address1
        city:
          anyOf:
            - type: string
              maxLength: 128
            - type: 'null'
          title: City
        state:
          anyOf:
            - type: string
              maxLength: 64
            - type: 'null'
          title: State
        postal_code:
          anyOf:
            - type: string
              maxLength: 16
            - type: 'null'
          title: Postal Code
      type: object
      required:
        - user_id
        - parent_origin
      title: EmbeddedCardConnectCreate
      description: >-
        Mint a card-connect embed session for an in-iframe (custom) card form.


        An alternative to the redirect-based ``connect`` flow: instead of
        bouncing

        the user to a hosted page, the platform embeds a Finogate iframe that

        renders a fully-custom card form. PAN is tokenised in-browser and never

        reaches the platform's or Finogate's servers.
    CommonResponse:
      properties:
        status_code:
          type: integer
          title: Status Code
          description: HTTP status code for the response.
        data:
          title: Data
          description: Payload or error details.
        query_generated_time:
          type: integer
          title: Query Generated Time
          description: >-
            UTC timestamp (milliseconds since epoch) when response was
            generated.
      type: object
      required:
        - status_code
        - data
        - query_generated_time
      title: CommonResponse
      description: |-
        Standard response wrapper for single-object responses and errors.

        Generic over the payload type. A route that declares
        ``CommonResponse[SomeModel]`` gets the real ``data`` schema rendered in
        OpenAPI/Swagger; a bare ``CommonResponse`` leaves ``data`` untyped.
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
  securitySchemes:
    _AuthenticatedBearer:
      type: oauth2
      flows:
        password:
          scopes: {}
          tokenUrl: /v1/platform/auth/token

````