Wallet Tokens

Tokenize Google Pay

Turn a Google Pay payment into a stored wallet token. Pass the PaymentMethodToken envelope exactly as Google Pay returns it — Guardian verifies the ECv2 signature chain and decrypts the payload server-side, so the decrypted card data never touches your systems.

The resulting wallet token carries one of two authentication methods, reflected in the auth_method field:

CRYPTOGRAM_3DS — a device-bound token with DPAN and cryptogram, forwardable once.
PAN_ONLY — a card-on-file token with the funding PAN, forwardable repeatedly and eligible for promotion to a network token.

Submitting the same envelope twice returns 409 with the classifier GOOGLE_PAY_DUPLICATE_PAYLOAD. Rejected envelopes return 422 with a classifier naming the cause: GOOGLE_PAY_SIGNATURE_INVALID, GOOGLE_PAY_DECRYPTION_FAILED, GOOGLE_PAY_TOKEN_EXPIRED, or GOOGLE_PAY_MALFORMED_TOKEN.

See Google Pay for prerequisites and the full flow.

POST

api

wallet

google-pay

tokenize

Tokenize Google Pay

curl --request POST \
  --url https://{cluster_id}.on-hellgate.cloud/api/wallet/google-pay/tokenize \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: <api-key>' \
  --data '
{
  "payment_method_token": {
    "protocolVersion": "ECv2",
    "signature": "MEQCIH6Q4OwQ...",
    "intermediateSigningKey": {
      "signedKey": "{\"keyValue\":\"MFkwEwYHK...\",\"keyExpiration\":\"1782914400000\"}",
      "signatures": [
        "MEYCIQDh0Ry..."
      ]
    },
    "signedMessage": "{\"encryptedMessage\":\"vXlWQTgA...\",\"ephemeralPublicKey\":\"BJatN...\",\"tag\":\"e5nDE...\"}"
  }
}
'

import requests

url = "https://{cluster_id}.on-hellgate.cloud/api/wallet/google-pay/tokenize"

payload = { "payment_method_token": {
        "protocolVersion": "ECv2",
        "signature": "MEQCIH6Q4OwQ...",
        "intermediateSigningKey": {
            "signedKey": "{\"keyValue\":\"MFkwEwYHK...\",\"keyExpiration\":\"1782914400000\"}",
            "signatures": ["MEYCIQDh0Ry..."]
        },
        "signedMessage": "{\"encryptedMessage\":\"vXlWQTgA...\",\"ephemeralPublicKey\":\"BJatN...\",\"tag\":\"e5nDE...\"}"
    } }
headers = {
    "x-api-key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    payment_method_token: {
      protocolVersion: 'ECv2',
      signature: 'MEQCIH6Q4OwQ...',
      intermediateSigningKey: {
        signedKey: '{"keyValue":"MFkwEwYHK...","keyExpiration":"1782914400000"}',
        signatures: ['MEYCIQDh0Ry...']
      },
      signedMessage: '{"encryptedMessage":"vXlWQTgA...","ephemeralPublicKey":"BJatN...","tag":"e5nDE..."}'
    }
  })
};

fetch('https://{cluster_id}.on-hellgate.cloud/api/wallet/google-pay/tokenize', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{cluster_id}.on-hellgate.cloud/api/wallet/google-pay/tokenize",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'payment_method_token' => [
        'protocolVersion' => 'ECv2',
        'signature' => 'MEQCIH6Q4OwQ...',
        'intermediateSigningKey' => [
                'signedKey' => '{"keyValue":"MFkwEwYHK...","keyExpiration":"1782914400000"}',
                'signatures' => [
                                'MEYCIQDh0Ry...'
                ]
        ],
        'signedMessage' => '{"encryptedMessage":"vXlWQTgA...","ephemeralPublicKey":"BJatN...","tag":"e5nDE..."}'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://{cluster_id}.on-hellgate.cloud/api/wallet/google-pay/tokenize"

	payload := strings.NewReader("{\n  \"payment_method_token\": {\n    \"protocolVersion\": \"ECv2\",\n    \"signature\": \"MEQCIH6Q4OwQ...\",\n    \"intermediateSigningKey\": {\n      \"signedKey\": \"{\\\"keyValue\\\":\\\"MFkwEwYHK...\\\",\\\"keyExpiration\\\":\\\"1782914400000\\\"}\",\n      \"signatures\": [\n        \"MEYCIQDh0Ry...\"\n      ]\n    },\n    \"signedMessage\": \"{\\\"encryptedMessage\\\":\\\"vXlWQTgA...\\\",\\\"ephemeralPublicKey\\\":\\\"BJatN...\\\",\\\"tag\\\":\\\"e5nDE...\\\"}\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("x-api-key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://{cluster_id}.on-hellgate.cloud/api/wallet/google-pay/tokenize")
  .header("x-api-key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"payment_method_token\": {\n    \"protocolVersion\": \"ECv2\",\n    \"signature\": \"MEQCIH6Q4OwQ...\",\n    \"intermediateSigningKey\": {\n      \"signedKey\": \"{\\\"keyValue\\\":\\\"MFkwEwYHK...\\\",\\\"keyExpiration\\\":\\\"1782914400000\\\"}\",\n      \"signatures\": [\n        \"MEYCIQDh0Ry...\"\n      ]\n    },\n    \"signedMessage\": \"{\\\"encryptedMessage\\\":\\\"vXlWQTgA...\\\",\\\"ephemeralPublicKey\\\":\\\"BJatN...\\\",\\\"tag\\\":\\\"e5nDE...\\\"}\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://{cluster_id}.on-hellgate.cloud/api/wallet/google-pay/tokenize")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"payment_method_token\": {\n    \"protocolVersion\": \"ECv2\",\n    \"signature\": \"MEQCIH6Q4OwQ...\",\n    \"intermediateSigningKey\": {\n      \"signedKey\": \"{\\\"keyValue\\\":\\\"MFkwEwYHK...\\\",\\\"keyExpiration\\\":\\\"1782914400000\\\"}\",\n      \"signatures\": [\n        \"MEYCIQDh0Ry...\"\n      ]\n    },\n    \"signedMessage\": \"{\\\"encryptedMessage\\\":\\\"vXlWQTgA...\\\",\\\"ephemeralPublicKey\\\":\\\"BJatN...\\\",\\\"tag\\\":\\\"e5nDE...\\\"}\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "id": "0d5c1774-5f3f-4a2f-9c86-1f30a0ea9be2",
  "kind": "google_pay_pan_only",
  "ingestion_path": "google_pay",
  "scheme": "visa",
  "auth_method": "PAN_ONLY",
  "requires_3ds": true,
  "promoted_to": null,
  "card": {
    "scheme": "visa",
    "last4": "4242",
    "expiry_month": 12,
    "expiry_year": 2028
  },
  "created_at": "2026-06-29T12:00:00Z",
  "deleted_at": null
}

{
  "code": 401,
  "message": "No valid means of authentication was provided",
  "classifier": "UNAUTHORIZED"
}

{
  "code": 403,
  "message": "Not allowed to access this resource or feature",
  "classifier": "FORBIDDEN"
}

{
  "code": 409,
  "message": "Conflict",
  "classifier": "CONFLICT"
}

{
  "code": 422,
  "classifier": "VALIDATION_ERROR",
  "message": "Validation error",
  "validation_errors": [
    {
      "path": "json-path",
      "message": "human readable error message"
    }
  ]
}

Authorizations

x-api-key

string

header

required

Body

application/json

payment_method_token

object

required

Google's PaymentMethodToken envelope, passed through verbatim as returned by the Google Pay API — including its original camelCase keys.

Show child attributes

Response

Success response

string<uuid>

required

kind

string

required

The specific credential kind, e.g. google_pay_pan_only or google_pay_cryptogram_3ds.

Example:

"google_pay_pan_only"

ingestion_path

string

required

The wallet the token was ingested from.

Example:

"google_pay"

scheme

enum<string>

required

Available options:

visa,

mastercard,

american express,

discover,

diners club,

jcb,

unionpay

card

object

required

Show child attributes

created_at

string<date-time>

required

auth_method

enum<string>

The authentication method of the Google Pay credential. Determines which placeholders are available when forwarding and whether the token can be promoted.

Available options:

PAN_ONLY,

CRYPTOGRAM_3DS

requires_3ds

boolean

Whether the payment still requires 3-D Secure authentication on your side.

promoted_to

string<uuid>

The ID of the network token this wallet token was promoted to. null until the token is promoted.

deleted_at

string<date-time>

Set when the token has been deleted and its card data scrubbed.

Get wallet tokensList all wallet tokens.

⌘I

Tokenize Google Pay

curl --request POST \
  --url https://{cluster_id}.on-hellgate.cloud/api/wallet/google-pay/tokenize \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: <api-key>' \
  --data '
{
  "payment_method_token": {
    "protocolVersion": "ECv2",
    "signature": "MEQCIH6Q4OwQ...",
    "intermediateSigningKey": {
      "signedKey": "{\"keyValue\":\"MFkwEwYHK...\",\"keyExpiration\":\"1782914400000\"}",
      "signatures": [
        "MEYCIQDh0Ry..."
      ]
    },
    "signedMessage": "{\"encryptedMessage\":\"vXlWQTgA...\",\"ephemeralPublicKey\":\"BJatN...\",\"tag\":\"e5nDE...\"}"
  }
}
'

import requests

url = "https://{cluster_id}.on-hellgate.cloud/api/wallet/google-pay/tokenize"

payload = { "payment_method_token": {
        "protocolVersion": "ECv2",
        "signature": "MEQCIH6Q4OwQ...",
        "intermediateSigningKey": {
            "signedKey": "{\"keyValue\":\"MFkwEwYHK...\",\"keyExpiration\":\"1782914400000\"}",
            "signatures": ["MEYCIQDh0Ry..."]
        },
        "signedMessage": "{\"encryptedMessage\":\"vXlWQTgA...\",\"ephemeralPublicKey\":\"BJatN...\",\"tag\":\"e5nDE...\"}"
    } }
headers = {
    "x-api-key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    payment_method_token: {
      protocolVersion: 'ECv2',
      signature: 'MEQCIH6Q4OwQ...',
      intermediateSigningKey: {
        signedKey: '{"keyValue":"MFkwEwYHK...","keyExpiration":"1782914400000"}',
        signatures: ['MEYCIQDh0Ry...']
      },
      signedMessage: '{"encryptedMessage":"vXlWQTgA...","ephemeralPublicKey":"BJatN...","tag":"e5nDE..."}'
    }
  })
};

fetch('https://{cluster_id}.on-hellgate.cloud/api/wallet/google-pay/tokenize', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{cluster_id}.on-hellgate.cloud/api/wallet/google-pay/tokenize",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'payment_method_token' => [
        'protocolVersion' => 'ECv2',
        'signature' => 'MEQCIH6Q4OwQ...',
        'intermediateSigningKey' => [
                'signedKey' => '{"keyValue":"MFkwEwYHK...","keyExpiration":"1782914400000"}',
                'signatures' => [
                                'MEYCIQDh0Ry...'
                ]
        ],
        'signedMessage' => '{"encryptedMessage":"vXlWQTgA...","ephemeralPublicKey":"BJatN...","tag":"e5nDE..."}'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://{cluster_id}.on-hellgate.cloud/api/wallet/google-pay/tokenize"

	payload := strings.NewReader("{\n  \"payment_method_token\": {\n    \"protocolVersion\": \"ECv2\",\n    \"signature\": \"MEQCIH6Q4OwQ...\",\n    \"intermediateSigningKey\": {\n      \"signedKey\": \"{\\\"keyValue\\\":\\\"MFkwEwYHK...\\\",\\\"keyExpiration\\\":\\\"1782914400000\\\"}\",\n      \"signatures\": [\n        \"MEYCIQDh0Ry...\"\n      ]\n    },\n    \"signedMessage\": \"{\\\"encryptedMessage\\\":\\\"vXlWQTgA...\\\",\\\"ephemeralPublicKey\\\":\\\"BJatN...\\\",\\\"tag\\\":\\\"e5nDE...\\\"}\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("x-api-key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://{cluster_id}.on-hellgate.cloud/api/wallet/google-pay/tokenize")
  .header("x-api-key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"payment_method_token\": {\n    \"protocolVersion\": \"ECv2\",\n    \"signature\": \"MEQCIH6Q4OwQ...\",\n    \"intermediateSigningKey\": {\n      \"signedKey\": \"{\\\"keyValue\\\":\\\"MFkwEwYHK...\\\",\\\"keyExpiration\\\":\\\"1782914400000\\\"}\",\n      \"signatures\": [\n        \"MEYCIQDh0Ry...\"\n      ]\n    },\n    \"signedMessage\": \"{\\\"encryptedMessage\\\":\\\"vXlWQTgA...\\\",\\\"ephemeralPublicKey\\\":\\\"BJatN...\\\",\\\"tag\\\":\\\"e5nDE...\\\"}\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://{cluster_id}.on-hellgate.cloud/api/wallet/google-pay/tokenize")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"payment_method_token\": {\n    \"protocolVersion\": \"ECv2\",\n    \"signature\": \"MEQCIH6Q4OwQ...\",\n    \"intermediateSigningKey\": {\n      \"signedKey\": \"{\\\"keyValue\\\":\\\"MFkwEwYHK...\\\",\\\"keyExpiration\\\":\\\"1782914400000\\\"}\",\n      \"signatures\": [\n        \"MEYCIQDh0Ry...\"\n      ]\n    },\n    \"signedMessage\": \"{\\\"encryptedMessage\\\":\\\"vXlWQTgA...\\\",\\\"ephemeralPublicKey\\\":\\\"BJatN...\\\",\\\"tag\\\":\\\"e5nDE...\\\"}\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "id": "0d5c1774-5f3f-4a2f-9c86-1f30a0ea9be2",
  "kind": "google_pay_pan_only",
  "ingestion_path": "google_pay",
  "scheme": "visa",
  "auth_method": "PAN_ONLY",
  "requires_3ds": true,
  "promoted_to": null,
  "card": {
    "scheme": "visa",
    "last4": "4242",
    "expiry_month": 12,
    "expiry_year": 2028
  },
  "created_at": "2026-06-29T12:00:00Z",
  "deleted_at": null
}

{
  "code": 401,
  "message": "No valid means of authentication was provided",
  "classifier": "UNAUTHORIZED"
}

{
  "code": 403,
  "message": "Not allowed to access this resource or feature",
  "classifier": "FORBIDDEN"
}

{
  "code": 409,
  "message": "Conflict",
  "classifier": "CONFLICT"
}

{
  "code": 422,
  "classifier": "VALIDATION_ERROR",
  "message": "Validation error",
  "validation_errors": [
    {
      "path": "json-path",
      "message": "human readable error message"
    }
  ]
}