---
title: Tokenization API
slug: tokenization-api
docTags: 
createdAt: 2026-06-01T13:20:13.766Z
---

# Overview

The **Forter Tokenization API** provides a secure way to tokenize sensitive payment card information, ensuring PCI compliance while enabling seamless transaction processing.

This guide covers:

- **Authentication methods** for API requests
- **Environment setup** (sandbox and production)
- **Client-side authentication** for Hosted Fields SDK users

# Authentication

The Forter Tokenization API uses **HTTP Basic authentication** to verify merchant requests. Authentication credentials must be included in the `Authorization` header using the **Basic Auth format**:

```nodejs
Authorization: Basic TO_BASE64(site_id:site_secret)
```

Replace `site_id` and `site_secret` with your actual credentials. Note that your Tokenization API credentials differ from your Core API.

***

# Sandbox environment

## What is Sandbox?

The **sandbox environment** is a free testing environment designed for integration and validation before transitioning to production. No real transactions are processed, and PCI information is not stored

## Sandbox Credentials & API Endpoint

:::CodeblockTabs
Base URL

```text
https://pci-tokenization-sandbox.checkouttools.com/v1/
```
:::

OpenAPI Schema is available [here](https://pci-tokenization-sandbox.checkouttools.com/documentation)

## Test Card Numbers

Since the sandbox cannot store PCI-sensitive data, only the following **hardcoded test PANs** are accepted:

| **Test Card Number** | **Card Type (If Applicable)** |
| -------------------- | ----------------------------- |
| 4111111111111111     | Visa                          |
| 5211111111111117     | Mastercard                    |
| 341111111111111      | American Express              |
| 6511111111111112     | Discover                      |
| 3528111111111110     | JCB                           |
| 36111111111111       | Diners Club                   |

These PANs are reserved for tokenization testing and carry no additional behaviour — they do not
trigger 3DS authentication, exemptions, or any other downstream test scenario.

:::hint{type="info"}
If you require a specific test card issued by a third party, please contact us.
:::

# Production environment

## Transitioning to Production

Once you are ready to go live, you **must request production credentials**. Sandbox credentials do **not** work in production.

## Security Requirements

As an additional security measure, Forter requires you to **provide the IP addresses** of the backend instances that will interact with the **Tokenization API**.

## Production API Endpoint

:::CodeblockTabs
Base URL

```text
https://pci.checkouttools.com/v1/
```
:::

For full API documentation, please refer to the [Tokenization](https://docs.forter.com/reference/create-multi-use-token) API Reference Page