Skip to main content

Cards

The card component allows you to show your customers their different cards, and allows them to manage the cards lifecycle:

  • Reveal card information
  • Activate card
  • Set / Change PIN
  • Freeze / unfreeze
  • Replace a damaged card
  • Report card lost/stolen
  • Add card to mobile wallet (only iOS, Android, or React Native)

Security & PCI Compliance

The Card component is designed to minimize your PCI compliance burden by isolating sensitive card data (PAN, CVV) from your application code and infrastructure.

How It Works

Web (iframe isolation):

  • Sensitive card data renders inside a cross-origin iframe served from Unit's secure domain
  • The browser's Same-Origin Policy creates a security boundary that prevents your JavaScript from accessing iframe contents
  • Session recording tools (e.g., LogRocket, FullStory), error tracking, and analytics running in your parent page cannot capture data inside the iframe
  • This is the same mechanism that prevents malicious websites from reading your Gmail or online banking sessions

Native SDK (iOS, Android, React Native):

  • Sensitive data renders in secure SDK contexts using platform-specific isolation mechanisms
  • Your application code never receives raw PAN/CVV values - only tokenized references
  • The SDK handles all sensitive data display and user interaction internally

Scope-Based Access Control

Access to sensitive card data is controlled through customer token scopes:

ScopeWhat It Allows
cardsRead card metadata (last 4 digits, status, limits, expiration month/year)
cards-writeFreeze/unfreeze, report lost/stolen, replace card
cards-sensitiveReveal full PAN, CVV (requires 2FA by default)
cards-sensitive-writeSet/change PIN

When generating a customer token, you specify which scopes to grant. Without cards-sensitive scope, the component will not render sensitive data even if a user requests it.

Upgradeable scopes: You can issue tokens with base scopes (e.g., cards) and upgrade to cards-sensitive after the user completes 2FA, avoiding pre-authorization of sensitive access.

// Example: Generate token with upgradeable scope
const response = await fetch('https://api.s.unit.sh/customers/123/token', {
method: 'POST',
headers: {
'Authorization': `Bearer ${orgToken}`,
'Content-Type': 'application/vnd.api+json'
},
body: JSON.stringify({
data: {
type: 'customerToken',
attributes: {
scope: 'cards cards-write',
upgradableScope: 'cards-sensitive' // Can upgrade after 2FA
}
}
})
});
Card Component TEST MODE
Mobile
Desktop

Note: The preview is in Sandbox, meaning this is not a real card.

Implementation