Stripe: Tokens schemas
1 Stripe schema with complete fields and constraints.
← Tokens operations · All schemas
Retrieve a token — response body
| Field | Type | Presence | Description and constraints |
|---|---|---|---|
$ | object | Root | Tokenization is the process Stripe uses to collect sensitive card or bank account details, or personally identifiable information (PII), directly from your customers in a secure manner. A token representing this information is returned to your server to use. Use our [recommended payments integrations](https://docs.stripe.com/payments) to perform this process on the client-side. This guarantees that no sensitive card data touches your server, and allows your integration to operate in a PCI-compliant way. If you can't use client-side tokenization, you can also create tokens using the API with either your publishable or secret API key. If your integration uses this method, you're responsible for any PCI compliance that it might require, and you must keep your secret API key safe. Unlike with client-side tokenization, your customer's information isn't sent directly to Stripe, so we can't determine how it's handled or stored. You can't store or use tokens more than once. To store card or bank account information for later use, create [Customer](https://docs.stripe.com/api#customers) objects or [External accounts](/api#external_accounts). [Radar](https://docs.stripe.com/radar), our integrated solution for automatic fraud protection, performs best with integrations that use client-side tokenization. |
bank_account | Model | Optional | Expand Retrieve a bank account — response body |
card | Model | Optional | Expand Retrieve a card — customers get Customers Customer Cards Id — response body |
client_ip | JSON | Optional | |
client_ip (anyOf 1) | string | Alternative | IP address of the client that generates the token. Maximum length: 5000 |
client_ip (anyOf 2) | null | Alternative | |
created | JSON | Required within parent | |
created (anyOf 1) | integer | Alternative | Time at which the object was created. Measured in seconds since the Unix epoch. Format: unix-time |
created (anyOf 2) | string | Alternative | Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$ |
id | string | Required within parent | Unique identifier for the object. Maximum length: 5000 |
livemode | boolean | Required within parent | If the object exists in live mode, the value is `true`. If the object exists in test mode, the value is `false`. |
object | string | Required within parent | String representing the object's type. Objects of the same type share the same value. Known values: token |
type | string | Required within parent | Type of the token: `account`, `bank_account`, `card`, or `pii`. Maximum length: 5000 |
used | boolean | Required within parent | Determines if you have already used this token (you can only use tokens once). |
Referenced models: Retrieve a bank account — response body, Retrieve a card — customers get Customers Customer Cards Id — response body