curl --request POST \
--url https://laso.finance/start-card-issuer-link \
--header 'Authorization: <api-key>' \
--header 'Content-Type: application/json' \
--data '{}'{
"status": "code_sent",
"channel": "email",
"sent_to": "j***@e***.com",
"expires_at": 1790026656711,
"note": "A one-time code was sent to the account holder's email. Ask the account holder to enter it in your interface, then send it to POST /verify-card-issuer-link. Never read the account holder's email yourself."
}Send the account holder a code to link the card issuer
Starts the one-time card issuer link: the card issuer sends a one-time code to the account holder. Then call POST /verify-card-issuer-link with the code they enter.
The account holder, never the agent, receives and enters the code. Send your human to their own inbox (or phone) and have them type the code into your interface. Never try to read the account holder’s email or messages yourself, and never ask for their email password or access.
Where the code goes. An account with an email on file always gets the code at that email; email and phone are ignored for it. An account with no email (a wallet-only sign-in) must send exactly one of email or phone (E.164). The response names the destination masked, never in full.
Limits. Codes last 10 minutes. At most 5 codes can be sent per account in any rolling hour (429, with Retry-After). Sending a new code replaces the previous one, which then stops working.
Prerequisite: Laso identity verification (403 kyc_required otherwise, with a kyc_url). If the account is already linked, this answers 200 with status: linked and sends nothing, so calling it twice is safe.
This route is free.
curl --request POST \
--url https://laso.finance/start-card-issuer-link \
--header 'Authorization: <api-key>' \
--header 'Content-Type: application/json' \
--data '{}'{
"status": "code_sent",
"channel": "email",
"sent_to": "j***@e***.com",
"expires_at": 1790026656711,
"note": "A one-time code was sent to the account holder's email. Ask the account holder to enter it in your interface, then send it to POST /verify-card-issuer-link. Never read the account holder's email yourself."
}Authorizations
Firebase ID token from /auth or any paid route, sent as a Bearer token: Authorization: Bearer <id_token> (the Bearer prefix is required).
Headers
Optional client-generated unique key (a UUID works) that makes this write safe to retry. A retry with the same key within 24 hours returns the recorded response of the original request, marked with an Idempotency-Replayed: true header, instead of performing the write again. Reusing a key with a different body or route is rejected with 422 (code: idempotency_key_reused); a retry that arrives while the original is still running gets 409 (code: idempotency_key_in_progress), so wait a moment and retry with the same key. Keys are scoped to the authenticated account.
255Body
Response
The code was sent, or the account is already linked.
Was this page helpful?