Confirmation Token

A Confirmation Token is a single-use, short-lived reference to a payment method and billing details collected from a buyer. Its response never returns the underlying payment credential. Public callers receive a billing preview; bearer-authenticated callers with payment:basic:read on the token’s account also receive the collected billing address. Whop Elements mint the token in your buyer-facing collection flow and hand you its ctok_ ID to send to the Payments API from your server. Retrieve a token to display its payment method and billing preview or check whether it is still usable.

Endpoints

Endpoint	Request
Retrieve Confirmation Token	GET `/confirmation_tokens/{id}`

Attributes

string

required

object | null

required

The collected billing address, including the name on the address. Null when not collected or without bearer authentication with payment:basic:read on the token’s account.

Properties

string | null

required

The city.

string | null

required

The ISO 3166-1 alpha-2 country code.

string | null

required

The first street address line.

string | null

required

The second street address line.

string | null

required

The name on the address.

string | null

required

The postal or ZIP code.

string | null

required

The state, province or region.

object | null

required

Billing preview supplied at collection: email, name, country and postal code.

Properties

string | null

required

ISO 3166-1 alpha-2 country code.

string | null

required

Email supplied when the method was collected.

string | null

required

Name on the payment method.

string | null

required

Postal or ZIP code.

string

required

When the token was created, as an ISO 8601 timestamp.

string

required

When the token expires, as an ISO 8601 timestamp. Tokens are single-use and short-lived.

string

required

Always confirmation_token.

object

required

Display-only preview of the collected method — never the underlying token.

Properties

string | null

required

The saved payment method this preview came from, or null when the buyer supplied a new one.

object

Present when the category is bank_debit. Empty until the account is charged.

Properties

string

Lowercase card brand, such as visa or mastercard.

string

Uniquely identifies this particular card number. Matches the fingerprint on any payment method saved from this token, so you can recognize a card across attempts. For a wallet, this identifies the network token rather than the underlying card.

string

The last four digits of the card.

object

Details of the card, when the category is card.

Properties

string

Lowercase card brand, such as visa or mastercard.

string

The last four digits of the card.

string

required

The family the type belongs to.Available options: card, wallet, bank_debit, bank_transfer, voucher, redirect, crypto, balance, in_app_purchase, card_present, saved

string

required

Human-readable label for the method, e.g. Visa •••• 4242.

object

Details of the stored card, when the category is saved. Absent for a balance.

Properties

string

Lowercase card brand, such as visa or mastercard.

string

The last four digits of the card.

string

required

The payment method type, e.g. card, apple_pay, klarna.

object

Details of the network token the wallet supplied, when the category is wallet.

Properties

string

Lowercase card brand, such as visa or mastercard.

string

The last four digits of the card.

string | null

required

Save-consent state the element displayed at collection: off_session, on_session, or null. Confirm may vault only if attested here.

string

required

pending until it is used, then consumed; expired once its short lifetime elapses. Only a pending token can be charged.Available options: pending, consumed, expired

ConfirmationToken

{
	"id": "ctok_xxxxxxxxxxxxxx",
	"object": "confirmation_token",
	"status": "pending",
	"payment_method_preview": {
		"id": null,
		"type": "card",
		"category": "card",
		"display_name": "Visa •••• 4242",
		"card": {
			"brand": "visa",
			"fingerprint": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
			"last4": "4242"
		}
	},
	"setup_future_usage": "off_session",
	"billing_details": {
		"email": "buyer@example.com",
		"name": "Buyer Name",
		"country": "US",
		"postal_code": "78701"
	},
	"billing_address": null,
	"created_at": "2026-08-28T12:00:00.000Z",
	"expires_at": "2026-08-28T12:15:00.000Z"
}

​Endpoints

​Attributes

Endpoints

Attributes