Skip to main content
How to encrypt payment data before sending it to Nuvion’s API.

Overview

All sensitive payment data (card numbers, CVV, etc.) must be encrypted using RSA-OAEP with SHA-256 before being sent to the API. Why encryption? Encrption is necessary for the following reasons:
  • Protects card data in transit (even over HTTPS)
  • Prevents data from being logged or cached
  • Ensures only Nuvion can decrypt the sensitive data
  • PCI DSS compliance

Getting Your Public Key

To Get your RSA Public Key in PEM format:
  • Login into your approved Nuvion account
  • Navigate to Settings > “Developers”
  • Click on Create Key button to create API key
  • The public encryption key will be displayed along the secret key. The encryption key is copiable and can be used to encrypt card data before sending it to Nuvion’s API.

Encryption Algorithm

  • Algorithm: RSA-OAEP
  • Hash Function: SHA-256
  • Padding: OAEP (Optimal Asymmetric Encryption Padding)
  • Encoding: Base64

Card Data Validation

Before encrypting, validate the card data:

Card Number

  • Remove all spaces and dashes
  • Must be 13-19 digits
  • Should pass Luhn check (checksum validation)

Expiry Date

  • Month: 01-12 (two digits)
  • Year: YYYY format (e.g., 2025)
  • Must be in the future

CVV

  • 3 digits for most cards
  • 4 digits for American Express

Cardholder Name

  • Minimum 1 character
  • Only letters, spaces, hyphens, and apostrophes

Encrypting Card Data

Use the RSA public key to encrypt card data using RSA-OAEP with SHA-256. Encrypt the following card data as a JSON object:

Implementation Examples

Node.js Example
Python (cryptography)

Common Errors

Decryption Failed

Causes:
  • Using wrong public key (sandbox vs production)
  • Incorrect encryption algorithm (must be RSA-OAEP with SHA-256)
  • Malformed card data JSON
  • Base64 encoding error

Invalid Card Data

Causes:
  • Card number fails Luhn check
  • Expired card
  • Invalid CVV length
  • Missing required fields