Skip to main content
PUT
Update the logged-in customer's payment method
Portal endpoints authenticate via the portal_session cookie issued by magic-link verification — not a Bearer API key. State-changing portal calls must additionally echo the portal_csrf cookie’s value in the X-CSRF-Token header (double-submit CSRF).
Updates the vaulted payment method for the authenticated portal customer. The card metadata (brand / last4 / expiry) is produced by the client-side gateway tokenization step — no raw card number (PAN) is ever accepted. The customer is resolved from the portal session and can never be supplied in the body.

Request body

Example Request

Response

To collect a new card through Stripe first, start with Start Card Update; for US bank accounts use Start Bank Account Setup.

Authorizations

portal_session
string
cookie
required

Customer-portal session cookie issued by GET /portal/auth/verify.

Body

application/json
card_brand
string
required
Example:

"visa"

card_last4
string
required
Required string length: 4
Example:

"4242"

card_exp_month
integer
required
Required range: 1 <= x <= 12
card_exp_year
integer
required
Required range: x >= 2020

Response

Payment method updated.

status
string
Example:

"ok"