QuickBooks: Create a card from a token

← payments_cards operations · Get started · OpenAPI downloads

Contract 2026-10-20 · Operation quickbooks.payments.cards.create_a_card_from_a_token

Provider route: POST /quickbooks/v4/customers/{id}/cards/createFromToken. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/quickbooks with npm, or alter-sdk-quickbooks with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { QuickBooksIntegration } from "@alter-ai/quickbooks";

async function execute(input: Parameters<QuickBooksIntegration["paymentsCards"]["createFromToken"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new QuickBooksIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.paymentsCards.createFromToken(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_quickbooks import QuickBooksIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = QuickBooksIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.payments_cards.create_from_token(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
query	object	Optional	Additional keys: not allowed
path	object	Required within parent	Additional keys: not allowed
path.id	string	Required within parent	Minimum length: 1
headers	object	Required within parent	Additional keys: not allowed
headers.request-Id	string	Required within parent	The request-Id that uniquely identifies the HTTP request sent by your app to the server. This lets apps correlate requests and responses in case it needs to resend a request due to a dropped connection. Maximum length: 50
body	object	Required within parent	Additional keys: not allowed
body.address	Model	Optional	Expand Create a card — request body — body address The cardholder’s full address.
body.cardType	string	Optional	The type of credit or debit card. Valid values: VISA MC AMEX DISC DINERS JCB Conditionally required
body.commercialCardCode	string	Optional	A code that indicates if the card is a commercial or corporate card. This can be used to track specific business purchases. Maximum length: 25
body.created	string	Optional	The time the object was originally created. In ISO 8601 date-time format. It appears as YYYY-MM-DDTHH:MM:SSZ . Read only: true
body.cvc	string	Optional	The Card Verification Code (CVC) on the back of the card. This can be up to four digits. The number varies by card provider. For security purposes, the CVC value can’t be stored. It must be supplied in transaction requests and then erased.
body.default	JSON	Optional	Indicates if the credit or debit card is the default. When users set a default, the flag is true . This is the credit or debit card QuickBooks uses when another isn’t specified. The flag defaults to false . When a credit or debit card flag is true, all other cards are automatically set to false.
body.default (anyOf 1)	boolean	Alternative
body.default (anyOf 2)	string	Alternative	One of: true, false
body.expMonth	string	Optional	The card’s two digit expiration month.
body.expYear	string	Optional	The card’s four digit expiration year.
body.id	string	Optional	The unique identifier for the card object. Conditionally required
body.isBusiness	JSON	Optional	This flag is set to true if the credit or debit card is a business card.
body.isBusiness (anyOf 1)	boolean	Alternative
body.isBusiness (anyOf 2)	string	Alternative	One of: true, false
body.isLevel3Eligible	JSON	Optional	Flag set to true if the credit or debit card falls into the L3 eligible Bank Identification Number (BIN) range.
body.isLevel3Eligible (anyOf 1)	boolean	Alternative
body.isLevel3Eligible (anyOf 2)	string	Alternative	One of: true, false
body.name	string	Optional	The name of the credit or debit card holder, as it appears on the card. Maximum length: 30
body.number	string	Optional	The credit or debit card number.
body.updated	string	Optional	The time the object was last updated. In ISO 8601 date-time format. It appears as YYYY-MM-DDTHH:MM:SSZ . Conditionally required Read only: true
body.entityId	string	Optional	The ID of the entity the card is associated with.
body.entityType	string	Optional	The entity or user type the card is associated with. Example values: Customer , Employee , Vendor or Company .
body.zeroDollarVerification	Model	Optional	Expand Create a card — response body — zero Dollar Verification Stores card verification information.
body.value	string	Required within parent	The ID of the system generated token. Learn more about the token entity.

Referenced models: Create a card — response body — zero Dollar Verification, Create a card — request body — body address

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
$	Model	Root	Expand Create a card — response body

Referenced models: Create a card — response body

Policy, approvals and errors

SDK function policy ID: quickbooks.payments.cards.create_a_card_from_a_token. Catalog operation: payments/cards/create_a_card_from_a_token. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Official provider source