Vault & saved cards

Store a card-on-file as a reusable pm_… token and charge it later (e.g. for subscriptions or one-click checkout) — without ever handling a raw card number.

Token-only — never a PAN

Mint the token on the client with the Mobile SDK or the hosted COPYandPAY widget (the card is captured by the gateway), then send only the resulting registration_id to the Vault. The raw-card path is reserved for PCI-DSS-validated server integrations and is disabled by default.

Create a payment method

After the customer’s first (cardholder-initiated) payment tokenizes the card, save it:

bash

curl https://api.watenga.africa/v1/payment-methods \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: pm-create-INV-001" \
  -d '{
    "registration_id": "reg_from_sdk_or_widget",
    "customer_id": "cus_123",
    "card_brand": "VISA",
    "card_last4": "4242",
    "exp_month": "12",
    "exp_year": "2028"
  }'

typescript

// Node
const pm = await watenga.paymentMethods.create({
  registration_id: 'reg_from_sdk_or_widget',
  customer_id: 'cus_123',
}, { idempotencyKey: 'pm-create-INV-001' });
// => { id: 'pm_…', card: { brand, last4, … }, status: 'active' }

List & retrieve

bash

GET /v1/payment-methods?customer_id=cus_123&limit=20
GET /v1/payment-methods/pm_123

Charge a saved card

Charging a stored token is a merchant-initiated transaction (MIT) — no customer interaction and no CVV.

bash

curl https://api.watenga.africa/v1/payment-methods/pm_123/charge \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: charge-INV-002" \
  -d '{ "amount": "19.99", "currency": "USD", "reference": "INV-002" }'

typescript

const res = await watenga.paymentMethods.charge('pm_123', {
  amount: '19.99',
  currency: 'USD',
  reference: 'INV-002',
}, { idempotencyKey: 'charge-INV-002' });
// => { transaction_id, payment_method_id, status: 'completed' }

Delete

bash

DELETE /v1/payment-methods/pm_123

Always send an Idempotency-Key on writes

Create and charge are money-adjacent — pass a stable Idempotency-Key so a retried request is de-duplicated by the API instead of vaulting or charging twice.