Sign Up
Creates a new anonymous reloadable card account. Takes no parameters. Returns the only two credentials that will ever exist for this account.
Call this from the browser
This endpoint is heavily rate limited and is designed to be requested client side, directly from the end customer's browser, so that the limit is scoped to that customer. A server-side proxy funnels every one of your customers through a single limit and will be throttled almost immediately.
Expect it to be slow
The account and its cryptographic material are provisioned during the request, so the response commonly takes 20 to 60 seconds. Do not set a short client timeout — allow at least 90 seconds. Render a spinner for the entire wait with copy that sets the expectation, for example: “Securely creating your account — this can take up to a minute. Please keep this page open.”
Retry policy
If the request fails or returns 400 Bad Request, retry exactly once, keeping the spinner on screen. Do not loop: repeated attempts will trip the rate limit and lock the customer out of signing up for a while. If the single retry also fails, tell the customer to try again in a few minutes.
Response
token: the permanent recovery credential, URL-encoded. Used only with signin.php. Store it verbatim, including the%2B,%2Fand%3Descapes.session: the working credential. Pass it as thesessionparameter on every other endpoint in this collection.
None.
{
"token": "NBcvfznMlfzL4ey%2BJmhdcdKVJpQBBqIxuOfZ2GFpbD0Orblz7zfywxXN4Te0Jheo%2F5vGoUuXwfrfxOd9zVOcTw%3D%3D",
"session": "JSgPHmS2RHUFoR5bsBDw2Gklw_NghKvZs0D9nn9AaiU"
}async function signUp() {
const URL = "https://api.paygate.to/crypto/cards/reloadable/signup.php";
// The call is slow by design — keep the spinner up for the whole wait.
showSpinner("Securely creating your account — this can take up to a minute.");
async function attempt() {
const r = await fetch(URL, { headers: { Accept: "application/json" } });
if (!r.ok) throw new Error("HTTP " + r.status); // 400 lands here
const d = await r.json();
if (!d || !d.token || !d.session) throw new Error("Malformed response");
return d;
}
let data;
try {
data = await attempt();
} catch (e) {
// Retry ONCE only. Never loop — the endpoint is rate limited.
data = await attempt();
} finally {
hideSpinner();
}
// The customer MUST store both values before continuing.
return data; // { token, session }
}Block the flow until the customer has saved the pair. Show the token and session in copyable fields, offer a download, and require an explicit acknowledgement before moving on. There is no second chance to display them.