Skip to main content
A card’s full details (PAN, CVV, expiry date) are sensitive data that Reap holds on your behalf. There are two ways to get at them, and the right one depends on whether the values need to reach your own systems.

​
Choosing an approach

Start with Secure Display. It covers the common case: showing a cardholder their own card details in your app. Raw card data never enters your systems, so your PCI DSS obligations do not change. Use Encrypted Retrieval only when the raw values must reach your backend and your environment is already PCI DSS compliant. Reap reviews your compliance status before enabling it per program. Projects without it receive 403 PAN_REVEAL_NOT_ENABLED. The two are not exclusive. A program approved for Encrypted Retrieval can still use Secure Display for its in-app reveal, and most do.

​
What both have in common

  • The card must be usable. It has to exist, not be in a terminal or inactive status, and belong to an active account.
  • Authenticate the cardholder first. Neither approach checks who is asking beyond your API key, so verify the user’s identity in your application before revealing anything.
  • Treat the output as short-lived. Do not cache, log, or persist reveal URLs or decrypted values.
  • Every retrieval is audited by Reap.