The Forter Tokenization API provides a secure way to tokenize sensitive payment card information, ensuring PCI compliance while enabling seamless transaction processing.

This guide covers:

The Forter Tokenization API uses HTTP Basic authentication to verify merchant requests. Authentication credentials must be included in the Authorization header using the Basic Auth format:

Replace site_id and site_secret with your actual credentials. Note that your Tokenization API credentials differ from your Core API.

The sandbox environment is a free testing environment designed for integration and validation before transitioning to production. No real transactions are processed, and PCI information is not stored

OpenAPI Schema is available here

Since the sandbox cannot store PCI-sensitive data, only the following hardcoded test PANs are accepted:

These PANs are reserved for tokenization testing and carry no additional behaviour — they do not trigger 3DS authentication, exemptions, or any other downstream test scenario.

Once you are ready to go live, you must request production credentials. Sandbox credentials do not work in production.

As an additional security measure, Forter requires you to provide the IP addresses of the backend instances that will interact with the Tokenization API.

For full API documentation, please refer to the Tokenization API Reference Page