Wallet Tokens

Tokenize Google Pay

Turn a Google Pay payment into a stored wallet token. Pass the PaymentMethodToken envelope exactly as Google Pay returns it — Guardian verifies the ECv2 signature chain and decrypts the payload server-side, so the decrypted card data never touches your systems.

The resulting wallet token carries one of two authentication methods, reflected in the auth_method field:

CRYPTOGRAM_3DS — a device-bound token with DPAN and cryptogram, forwardable once.
PAN_ONLY — a card-on-file token with the funding PAN, forwardable repeatedly and eligible for promotion to a network token.

Submitting the same envelope twice returns 409 with the classifier GOOGLE_PAY_DUPLICATE_PAYLOAD. Rejected envelopes return 422 with a classifier naming the cause: GOOGLE_PAY_SIGNATURE_INVALID, GOOGLE_PAY_DECRYPTION_FAILED, GOOGLE_PAY_TOKEN_EXPIRED, or GOOGLE_PAY_MALFORMED_TOKEN.

See Google Pay for prerequisites and the full flow.

POST

api

wallet

google-pay

tokenize

Tokenize Google Pay

curl --request POST \
  --url https://{instance}.{env}.on-hellgate.cloud/api/wallet/google-pay/tokenize \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "payment_method_token": {
    "protocolVersion": "ECv2",
    "signature": "MEQCIH6Q4OwQ...",
    "intermediateSigningKey": {
      "signedKey": "{\"keyValue\":\"MFkwEwYHK...\",\"keyExpiration\":\"1782914400000\"}",
      "signatures": [
        "MEYCIQDh0Ry..."
      ]
    },
    "signedMessage": "{\"encryptedMessage\":\"vXlWQTgA...\",\"ephemeralPublicKey\":\"BJatN...\",\"tag\":\"e5nDE...\"}"
  }
}
'

import requests

url = "https://{instance}.{env}.on-hellgate.cloud/api/wallet/google-pay/tokenize"

payload = { "payment_method_token": {
        "protocolVersion": "ECv2",
        "signature": "MEQCIH6Q4OwQ...",
        "intermediateSigningKey": {
            "signedKey": "{\"keyValue\":\"MFkwEwYHK...\",\"keyExpiration\":\"1782914400000\"}",
            "signatures": ["MEYCIQDh0Ry..."]
        },
        "signedMessage": "{\"encryptedMessage\":\"vXlWQTgA...\",\"ephemeralPublicKey\":\"BJatN...\",\"tag\":\"e5nDE...\"}"
    } }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    payment_method_token: {
      protocolVersion: 'ECv2',
      signature: 'MEQCIH6Q4OwQ...',
      intermediateSigningKey: {
        signedKey: '{"keyValue":"MFkwEwYHK...","keyExpiration":"1782914400000"}',
        signatures: ['MEYCIQDh0Ry...']
      },
      signedMessage: '{"encryptedMessage":"vXlWQTgA...","ephemeralPublicKey":"BJatN...","tag":"e5nDE..."}'
    }
  })
};

fetch('https://{instance}.{env}.on-hellgate.cloud/api/wallet/google-pay/tokenize', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{instance}.{env}.on-hellgate.cloud/api/wallet/google-pay/tokenize",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'payment_method_token' => [
        'protocolVersion' => 'ECv2',
        'signature' => 'MEQCIH6Q4OwQ...',
        'intermediateSigningKey' => [
                'signedKey' => '{"keyValue":"MFkwEwYHK...","keyExpiration":"1782914400000"}',
                'signatures' => [
                                'MEYCIQDh0Ry...'
                ]
        ],
        'signedMessage' => '{"encryptedMessage":"vXlWQTgA...","ephemeralPublicKey":"BJatN...","tag":"e5nDE..."}'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://{instance}.{env}.on-hellgate.cloud/api/wallet/google-pay/tokenize"

	payload := strings.NewReader("{\n  \"payment_method_token\": {\n    \"protocolVersion\": \"ECv2\",\n    \"signature\": \"MEQCIH6Q4OwQ...\",\n    \"intermediateSigningKey\": {\n      \"signedKey\": \"{\\\"keyValue\\\":\\\"MFkwEwYHK...\\\",\\\"keyExpiration\\\":\\\"1782914400000\\\"}\",\n      \"signatures\": [\n        \"MEYCIQDh0Ry...\"\n      ]\n    },\n    \"signedMessage\": \"{\\\"encryptedMessage\\\":\\\"vXlWQTgA...\\\",\\\"ephemeralPublicKey\\\":\\\"BJatN...\\\",\\\"tag\\\":\\\"e5nDE...\\\"}\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://{instance}.{env}.on-hellgate.cloud/api/wallet/google-pay/tokenize")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"payment_method_token\": {\n    \"protocolVersion\": \"ECv2\",\n    \"signature\": \"MEQCIH6Q4OwQ...\",\n    \"intermediateSigningKey\": {\n      \"signedKey\": \"{\\\"keyValue\\\":\\\"MFkwEwYHK...\\\",\\\"keyExpiration\\\":\\\"1782914400000\\\"}\",\n      \"signatures\": [\n        \"MEYCIQDh0Ry...\"\n      ]\n    },\n    \"signedMessage\": \"{\\\"encryptedMessage\\\":\\\"vXlWQTgA...\\\",\\\"ephemeralPublicKey\\\":\\\"BJatN...\\\",\\\"tag\\\":\\\"e5nDE...\\\"}\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://{instance}.{env}.on-hellgate.cloud/api/wallet/google-pay/tokenize")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"payment_method_token\": {\n    \"protocolVersion\": \"ECv2\",\n    \"signature\": \"MEQCIH6Q4OwQ...\",\n    \"intermediateSigningKey\": {\n      \"signedKey\": \"{\\\"keyValue\\\":\\\"MFkwEwYHK...\\\",\\\"keyExpiration\\\":\\\"1782914400000\\\"}\",\n      \"signatures\": [\n        \"MEYCIQDh0Ry...\"\n      ]\n    },\n    \"signedMessage\": \"{\\\"encryptedMessage\\\":\\\"vXlWQTgA...\\\",\\\"ephemeralPublicKey\\\":\\\"BJatN...\\\",\\\"tag\\\":\\\"e5nDE...\\\"}\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "id": "0d5c1774-5f3f-4a2f-9c86-1f30a0ea9be2",
  "kind": "google_pay_pan_only",
  "ingestion_path": "google_pay",
  "scheme": "visa",
  "auth_method": "PAN_ONLY",
  "requires_3ds": true,
  "promoted_to": null,
  "card": {
    "scheme": "visa",
    "last4": "4242",
    "expiry_month": 12,
    "expiry_year": 2028
  },
  "created_at": "2026-06-29T12:00:00Z",
  "deleted_at": null
}

{
  "code": 401,
  "message": "No valid means of authentication was provided",
  "classifier": "UNAUTHORIZED"
}

{
  "code": 403,
  "message": "Not allowed to access this resource or feature",
  "classifier": "FORBIDDEN"
}

{
  "code": 409,
  "message": "Conflict",
  "classifier": "CONFLICT"
}

{
  "code": 422,
  "classifier": "VALIDATION_ERROR",
  "message": "Validation error",
  "validation_errors": [
    {
      "path": "json-path",
      "message": "human readable error message"
    }
  ]
}

Authorizations

Authorization

string

header

required

JWT bearer token obtained via the OAuth2 client-credentials grant from the platform Authentication API. The token's scopes gate the endpoints it may call, and its audience names the Guardian instance. This is the standard way to authenticate to Guardian.

Body

application/json

payment_method_token

object

required

Google's PaymentMethodToken envelope, passed through verbatim as returned by the Google Pay API — including its original camelCase keys.

Show child attributes

Response

Success response

string<uuid>

required

kind

enum<string>

required

The specific credential kind.

Available options:

google_pay_pan_only,

google_pay_cryptogram_3ds,

apple_pay_dpan

Example:

"google_pay_pan_only"

ingestion_path

string

required

The wallet the token was ingested from.

Example:

"google_pay"

scheme

enum<string>

required

Available options:

visa,

mastercard,

american express,

discover,

diners club,

jcb,

unionpay

card

object

required

Show child attributes

created_at

string<date-time>

required

Example:

"2026-06-29T12:00:00Z"

auth_method

enum<string>

The authentication method of the wallet credential. An Apple Pay token is always CRYPTOGRAM_3DS. Determines which placeholders are available when forwarding and whether the token can be promoted.

Available options:

PAN_ONLY,

CRYPTOGRAM_3DS

requires_3ds

boolean

Whether the payment still requires 3-D Secure authentication on your side.

promoted_to

string | null

The ID of the network token this wallet token was promoted to. null until the token is promoted.

Example:

null

deleted_at

string | null

Set when the token has been deleted and its card data scrubbed.

Example:

null

⌘I

Tokenize Google Pay

curl --request POST \
  --url https://{instance}.{env}.on-hellgate.cloud/api/wallet/google-pay/tokenize \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "payment_method_token": {
    "protocolVersion": "ECv2",
    "signature": "MEQCIH6Q4OwQ...",
    "intermediateSigningKey": {
      "signedKey": "{\"keyValue\":\"MFkwEwYHK...\",\"keyExpiration\":\"1782914400000\"}",
      "signatures": [
        "MEYCIQDh0Ry..."
      ]
    },
    "signedMessage": "{\"encryptedMessage\":\"vXlWQTgA...\",\"ephemeralPublicKey\":\"BJatN...\",\"tag\":\"e5nDE...\"}"
  }
}
'

import requests

url = "https://{instance}.{env}.on-hellgate.cloud/api/wallet/google-pay/tokenize"

payload = { "payment_method_token": {
        "protocolVersion": "ECv2",
        "signature": "MEQCIH6Q4OwQ...",
        "intermediateSigningKey": {
            "signedKey": "{\"keyValue\":\"MFkwEwYHK...\",\"keyExpiration\":\"1782914400000\"}",
            "signatures": ["MEYCIQDh0Ry..."]
        },
        "signedMessage": "{\"encryptedMessage\":\"vXlWQTgA...\",\"ephemeralPublicKey\":\"BJatN...\",\"tag\":\"e5nDE...\"}"
    } }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    payment_method_token: {
      protocolVersion: 'ECv2',
      signature: 'MEQCIH6Q4OwQ...',
      intermediateSigningKey: {
        signedKey: '{"keyValue":"MFkwEwYHK...","keyExpiration":"1782914400000"}',
        signatures: ['MEYCIQDh0Ry...']
      },
      signedMessage: '{"encryptedMessage":"vXlWQTgA...","ephemeralPublicKey":"BJatN...","tag":"e5nDE..."}'
    }
  })
};

fetch('https://{instance}.{env}.on-hellgate.cloud/api/wallet/google-pay/tokenize', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{instance}.{env}.on-hellgate.cloud/api/wallet/google-pay/tokenize",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'payment_method_token' => [
        'protocolVersion' => 'ECv2',
        'signature' => 'MEQCIH6Q4OwQ...',
        'intermediateSigningKey' => [
                'signedKey' => '{"keyValue":"MFkwEwYHK...","keyExpiration":"1782914400000"}',
                'signatures' => [
                                'MEYCIQDh0Ry...'
                ]
        ],
        'signedMessage' => '{"encryptedMessage":"vXlWQTgA...","ephemeralPublicKey":"BJatN...","tag":"e5nDE..."}'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://{instance}.{env}.on-hellgate.cloud/api/wallet/google-pay/tokenize"

	payload := strings.NewReader("{\n  \"payment_method_token\": {\n    \"protocolVersion\": \"ECv2\",\n    \"signature\": \"MEQCIH6Q4OwQ...\",\n    \"intermediateSigningKey\": {\n      \"signedKey\": \"{\\\"keyValue\\\":\\\"MFkwEwYHK...\\\",\\\"keyExpiration\\\":\\\"1782914400000\\\"}\",\n      \"signatures\": [\n        \"MEYCIQDh0Ry...\"\n      ]\n    },\n    \"signedMessage\": \"{\\\"encryptedMessage\\\":\\\"vXlWQTgA...\\\",\\\"ephemeralPublicKey\\\":\\\"BJatN...\\\",\\\"tag\\\":\\\"e5nDE...\\\"}\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://{instance}.{env}.on-hellgate.cloud/api/wallet/google-pay/tokenize")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"payment_method_token\": {\n    \"protocolVersion\": \"ECv2\",\n    \"signature\": \"MEQCIH6Q4OwQ...\",\n    \"intermediateSigningKey\": {\n      \"signedKey\": \"{\\\"keyValue\\\":\\\"MFkwEwYHK...\\\",\\\"keyExpiration\\\":\\\"1782914400000\\\"}\",\n      \"signatures\": [\n        \"MEYCIQDh0Ry...\"\n      ]\n    },\n    \"signedMessage\": \"{\\\"encryptedMessage\\\":\\\"vXlWQTgA...\\\",\\\"ephemeralPublicKey\\\":\\\"BJatN...\\\",\\\"tag\\\":\\\"e5nDE...\\\"}\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://{instance}.{env}.on-hellgate.cloud/api/wallet/google-pay/tokenize")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"payment_method_token\": {\n    \"protocolVersion\": \"ECv2\",\n    \"signature\": \"MEQCIH6Q4OwQ...\",\n    \"intermediateSigningKey\": {\n      \"signedKey\": \"{\\\"keyValue\\\":\\\"MFkwEwYHK...\\\",\\\"keyExpiration\\\":\\\"1782914400000\\\"}\",\n      \"signatures\": [\n        \"MEYCIQDh0Ry...\"\n      ]\n    },\n    \"signedMessage\": \"{\\\"encryptedMessage\\\":\\\"vXlWQTgA...\\\",\\\"ephemeralPublicKey\\\":\\\"BJatN...\\\",\\\"tag\\\":\\\"e5nDE...\\\"}\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "id": "0d5c1774-5f3f-4a2f-9c86-1f30a0ea9be2",
  "kind": "google_pay_pan_only",
  "ingestion_path": "google_pay",
  "scheme": "visa",
  "auth_method": "PAN_ONLY",
  "requires_3ds": true,
  "promoted_to": null,
  "card": {
    "scheme": "visa",
    "last4": "4242",
    "expiry_month": 12,
    "expiry_year": 2028
  },
  "created_at": "2026-06-29T12:00:00Z",
  "deleted_at": null
}

{
  "code": 401,
  "message": "No valid means of authentication was provided",
  "classifier": "UNAUTHORIZED"
}

{
  "code": 403,
  "message": "Not allowed to access this resource or feature",
  "classifier": "FORBIDDEN"
}

{
  "code": 409,
  "message": "Conflict",
  "classifier": "CONFLICT"
}

{
  "code": 422,
  "classifier": "VALIDATION_ERROR",
  "message": "Validation error",
  "validation_errors": [
    {
      "path": "json-path",
      "message": "human readable error message"
    }
  ]
}

Getting Started

Tokens

Metadata

Admin

Tokenize Google Pay

Authorizations

Body

Response