Skip to main content
The full card number (PAN) and CVC are encrypted and only accessible through a secure retrieval flow. The last four digits and expiry date are always available. This page explains how to retrieve and decrypt the full details on the client so a cardholder can use a virtual card.

​
How retrieval works

Retrieving full card details requires an encrypted SessionId header so only the authorized cardholder can access the data. The flow has three steps:
1

Generate an encrypted session key

Generate a session key, then encrypt it with Rain’s RSA public key using RSA-OAEP. The encrypted value is your SessionId.
2

Request the encrypted details

Call Get a card’s encrypted data with the encrypted SessionId in the request header.
3

Decrypt on the client

Decrypt the returned PAN and CVC with your session key using AES.
Security best practices:
  • Never store decrypted card details.
  • Only request full card details when absolutely necessary.
  • Always use the latest encryption libraries to maintain security.

​
Implementation guides

For complete code, follow the guide for your environment:

​
What’s next

Test with simulations

Simulate card transactions in the sandbox before you go live.

Manage transactions

Follow transactions from authorization through settlement once cards are live.