Masking PAN and CSC

Mask the primary account number (PAN) and card security code (CSC) fields on your payment page to conceal card details as cardholders enter them.

Merchants: Use masking to help cardholders enter their card details more privately in public environments.

Developers: Configure masking in the order creation request using the Boolean flag merchantAttributes.maskPaymentInfo.

Enable masking

1. Add the merchantAttributes object to your order creation request, or update the existing object.
2. Set maskPaymentInfo to true within merchantAttributes.
3. Submit the order creation request with this setting.

Example request body

This example sets a purchase amount of 399 fils (AED 3.99) and enables masking:

{
  "action": "PURCHASE",
  "amount": {
    "currencyCode": "AED",
    "value": 399
  },
  "merchantAttributes": {
    "maskPaymentInfo": true
  }
}

With maskPaymentInfo set to true, the payment page masks both PAN and CSC inputs.

Optional: Leave PAN unmasked

Set merchantAttributes.maskPaymentInfo to false, or omit the flag from your order creation request, to leave the PAN input unmasked.