Reveal card details using secured sessions

You can allow your cardholders to view the details of their Adyen-issued card using secured sessions. Secured sessions use end-to-end encryption between your client and Adyen, without exposing sensitive card data to your server.

This page explains how to use secured sessions and Adyen's SDKs for iOS and Android to securely reveal card details in your user interface.

Requirements

Before you begin, take into account the requirements, preparations, and limitations specified in the following tabs.

Secured sessions with Adyen

With secured sessions, your server creates a session with specific permissions and scope. Your client can use this session to directly communicate with Adyen using Adyen's SDKs.

Adyen's SDKs for iOS and Android allow you to retrieve the card details from Adyen. Additionally, they automatically handle all cryptographic operations, such as key exchange, encryption, and decryption.

Secured sessions with Adyen's SDKs offers the following benefits:

• Your server never handles PCI-sensitive data, such as PAN and CVC.
• Sessions are scoped to a specific card and operation.
• Sessions are single-use, which prevents replay attacks.
• End-to-end encryption between the SDK and Adyen protects data in transit.

How it works

The following diagram illustrates the card details reveal flow using sessions.

As shown in the diagram, the steps for revealing the card details are:

1. Load the application certificate when your application starts.
2. Create a session instance.
3. Reveal card details.
4. Show the card details in your user interface.

1. Load the application certificate

Adyen provides you with an application certificate that you need to initialize Adyen's SDKs. The SDKs use this certificate to establish a secure session with Adyen.

When your application starts:

• Load the application certificate into your application.

  The following tabs show examples of how to load the certificate on each SDK.

2. Create a session instance

When a cardholder using your application selects the option to reveal the card details, you must initialize the SDK. During initialization, you configure all objects and logic that handle your secure session with Adyen.

The following tabs show examples of how to initialize Adyen's SDKs for iOS and Android.

3. Reveal card details

After you initialize the SDK, you can create a secured session. Start the flow for a secured session by calling the CardSession.revealCardDetails SDK method. This method instructs the backend to make a request to our Session authentication API. Then, the SDK method retrieves the session data from the backend and returns it to your application.

To create a secured session:

1. From your application, call the session instance that you created. Pass the payment instrument ID as a parameter.
   This calls your token provider, which instructs the backend to retrieve a session token from Adyen.
   The following tabs show examples for iOS and Android.

2. From your backend, make a POST /sessions request with the following parameters:

   Parameter	Required	Description
   product		Set to platform.
   policy.resources.type		Set to paymentInstrument.
   policy.resources.paymentInstrumentId		The unique identifier of the payment instrument that the session is scoped to.
   policy.roles		An array of roles that define the allowed operations. Include the PaymentInstrument: Card Reveal role.

3. Verify that the response contains a session token.

4. Pass the token from your backend to the SDK. Use the token provider that you defined when you initialized the SDK.

If the request is successful, the SDK uses the token to establish a secure session with Adyen. The SDK uses the secure session to get the encrypted card details from Adyen. Then, the SDK decrypts the card details automatically. You do not need to make additional calls.

4. Show the card details in your user interface

After the SDK receives the session token from the backend, the CardSession.revealCardDetails method returns the decrypted card details, including the PAN, expiry date, and CVC.

To reveal the decrypted card details in your user interface:

1. Pass the decrypted card details to your app.
2. Reveal the card details to your cardholder in your user interface.

After you reveal the card details, delete them from your app's memory.

Troubleshooting

The following table describes errors that Adyen's SDKs can return and how to solve them.

See also

• Reveal card details with the iOS SDK
• Reveal card details with standard encryption