Skip to main content
POST
/
v1
/
platform
/
embed-tokens
Create an Embed Token
curl --request POST \
  --url https://api-sandbox.finogates.com/v1/platform/embed-tokens \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "parent_origin": "<string>",
  "scope": "add_card",
  "card_processing_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
'
{
  "status_code": 123,
  "data": "<unknown>",
  "query_generated_time": 123
}

Authorizations

​
Authorization
string
header
required

The access token received from the authorization server in the OAuth 2.0 flow.

Body

application/json

Request body for POST /v1/platform/embed-tokens.

​
user_id
string<uuid>
required

The end-user the iframe will act on behalf of. Must be an end_user belonging to the calling tenant.

​
parent_origin
string
required

The origin of the page that will embed the iframe (e.g. https://app.example.com). Used as the postMessage targetOrigin so success payloads cannot leak to other windows. Must be a bare origin: scheme + host + optional port, no path.

Maximum string length: 255
​
scope
enum<string>
default:add_card

Which embed surface the token authorises. Today the only supported scope is add_card.

Available options:
add_card,
add_bank,
card_payment
​
card_processing_id
string<uuid> | null

Optional. Only honored when scope='add_card'. Pins the card to a specific approved card-processing merchant account (the id returned by GET /v1/platform/card-processing/users/{user_id}). Omit to use the user's deterministically selected default merchant.

Response

Successful Response

Standard response wrapper for single-object responses and errors.

Generic over the payload type. A route that declares CommonResponse[SomeModel] gets the real data schema rendered in OpenAPI/Swagger; a bare CommonResponse leaves data untyped.

​
status_code
integer
required

HTTP status code for the response.

​
data
any
required

Payload or error details.

​
query_generated_time
integer
required

UTC timestamp (milliseconds since epoch) when response was generated.