Skip to main content

Card

The card component allows you to show your customers their different cards, and allows them to manage the cards lifecycle:

  • Reveal card information
  • Activate card
  • Set / Change PIN
  • Freeze / unfreeze
  • Replace a damaged card
  • Report card lost/stolen
  • Add card to mobile wallet (only iOS, Android, or React Native)

Security & PCI Compliance​

The Card component is designed to minimize your PCI compliance burden by isolating sensitive card data (PAN, CVV) from your application code and infrastructure.

How It Works​

Web (iframe isolation):

  • Sensitive card data renders inside a cross-origin iframe served from Unit's secure domain
  • The browser's Same-Origin Policy creates a security boundary that prevents your JavaScript from accessing iframe contents
  • Session recording tools (e.g., LogRocket, FullStory), error tracking, and analytics running in your parent page cannot capture data inside the iframe
  • This is the same mechanism that prevents malicious websites from reading your Gmail or online banking sessions

Native SDK (iOS, Android, React Native):

  • Sensitive data renders in secure SDK contexts using platform-specific isolation mechanisms
  • Your application code never receives raw PAN/CVV values - only tokenized references
  • The SDK handles all sensitive data display and user interaction internally

Scope-Based Access Control​

Access to sensitive card data is controlled through customer token scopes:

ScopeWhat It Allows
cardsRead card metadata (last 4 digits, status, limits, expiration month/year)
cards-writeFreeze/unfreeze, report lost/stolen, replace card
cards-sensitiveReveal full PAN, CVV (requires 2FA by default)
cards-sensitive-writeSet/change PIN

When generating a customer token, you specify which scopes to grant. Without cards-sensitive scope, the component will not render sensitive data even if a user requests it.

Upgradeable scopes: You can issue tokens with base scopes (e.g., cards) and upgrade to cards-sensitive after the user completes 2FA, avoiding pre-authorization of sensitive access.

// Example: Generate token with upgradeable scope
const response = await fetch('https://api.s.unit.sh/customers/123/token', {
method: 'POST',
headers: {
'Authorization': `Bearer ${orgToken}`,
'Content-Type': 'application/vnd.api+json'
},
body: JSON.stringify({
data: {
type: 'customerToken',
attributes: {
scope: 'cards cards-write',
upgradableScope: 'cards-sensitive' // Can upgrade after 2FA
}
}
})
});
Card Component TEST MODE
Mobile
Desktop

Note: The preview is in Sandbox, meaning this is not a real card.

Implementation