# Card Reveal Token

> Coming soon, upon request — this feature is turned on for your tenant by the Aurea team. [Contact us](https://www.aureahub.com/contact)

The token that lets the user see a card's details — number, expiry, security code — in the card program's secure display component, inside your app. The details never pass through your servers or Aurea's.

## Overview

- The card details are shown by the card program's secure display component, embedded in your app. Aurea gives the component's integration package to your team when Cards is turned on for your tenant [Coming soon, upon request](https://docs.aureahub.com/docs/feature-availability.md).
- Give the component this answer, on the user's device and nowhere else: `token` and `expiresAt`, a short-lived token of the card-reveal service; `appId`, your tenant's app at the card program; `gnosisJwt`, the user's card program session.
- **Illustrative example.** The values come from the card-reveal service as it answered them; the answer may carry fields not listed here.
- `403` `CARD_PROGRAM_SESSION_EXPIRED` without a session; `503` `CARD_REVEAL_NOT_CONFIGURED` until card reveal is set up [Coming soon, upon request](https://docs.aureahub.com/docs/feature-availability.md), or when the card-reveal service fails.

## Endpoint

### `GET /v1/cards/ephemeral-token`

Authentication: bearer token required.

A card-reveal token for the user's device.

**Responses**

`200` OK

```json
{
  "token": "…",
  "expiresAt": "2026-10-14T09:05:00.000Z",
  "appId": "…",
  "gnosisJwt": "eyJhbGciOi…"
}
```

`503` Not Set Up

```json
{
  "error": "ServiceUnavailableError",
  "message": "…",
  "details": { "code": "CARD_REVEAL_NOT_CONFIGURED" }
}
```

**Example request**

```bash
curl https://api.aureahub.com/v1/cards/ephemeral-token \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```

---

Web version: https://docs.aureahub.com/#cards-reveal-token