Confusion/Bug about encryption and validation on tokenizeCard

Hi there! I’m following the Credit Cards Tokenization | JS+Ruby guide and experiencing a hard time understanding the idea or purpose behind this way of calling it (I’m in sandbox fyi):

var client = new braintree.api.Client({clientToken: "TOKEN"});
client.tokenizeCard({
  number: "4000111111111115",
  cardholderName: "John Smith",
  expirationMonth: "10",
  expirationYear: "2018",
  cvv: "832",
  billingAddress: {
    postalCode: "94105"
  }
}, function (err, nonce) {
  console.log(err)
  console.log(nonce)
});

I had 2 doubts:

• For one side the data is not being encrypted before is sent to your servers you can see that in this attachment: I also could not set neither change the creditCard[options][validate]: false to true
• And on the other side I CC I’m trying in there is the one mention in the list of Unsuccessful credit card verification but the call to client.tokenizeCard returns without any error and with a nonce, wondering if this call is not in charge of verify the card and only just retrieve a nonce.

Also I could not found anywhere any doc or wiki explaining all the JS methods available:

Client.addCoinbase()
Client.addCreditCard()
Client.addPayPalAccount()
Client.createSEPAMandate()
Client.decryptBrowserswitchPayload()
Client.encryptBrowserswitchReturnPayload()
Client.exchangePaypalTokenForConsentCode()
Client.getCreditCards()
Client.lookup3DS()
Client.sendAnalyticsEvents()
Client.tokenizeCard()
Client.tokenizeCoinbase()
Client.tokenizePayPalAccount()
Client.unlockCreditCard()
Client.verify3DS()

Is there a doc for this?

Thanks a lot! Hope you have a nice day

[mrak]

That’s a great question, and it’s a particular (and slightly confusing) feature of sandbox accounts. Those test card cases were conceived before we had browser-side tokenization capabilities.

Credit Card Verification docs

We currently only return those verification results when creating/updating a customer or creating/updating a payment method through our server SDKs. You will also need to turn on card verification in the Control Panel

While using a sandbox account and validate: true, only the luhn-10 validity is checked. It’s only when you go to creating a payment method or customer with that nonce on your server that you will see the error cases described in Unsuccessful credit card verification

If you want an invalid card response from addCreditCard and validate: true, you can try 4111111111111112 as the card number

[mrak]

Hey @cavi21! I’m a developer at Braintree. I hope I can address all of your concerns.

RE no encryption

Direct use of braintree.api.Client does not use encryption. If you are using it directly, it is assumed that you have gone through the appropriate SAQ questionnaire where you handle credit card data through your own form. Details are sent over https and are encrypted, in a sense, with TLS.

RE verifying cards

tokenizeCard will always specify validate: false. It is a wrapper around the lower-level addCreditCard function which we do not currently document. We could do a better job with naming conventions to make the separation between functions that are intended to be public (such as tokenizeCard) and those that are internally used.

If you are looking for solutions that handle credit card information for you while still being able to use your own styles and checkout, you can take a look at our Hosted Fields integration.

• Hosted Fields on the marketing page
• Hosted Fields documentation

If you still want to only use the Client directly, you can use addCreditCard as follows:

client.addCreditCard({
  options: { validate: true },
  number: "4000111111111115",
  cardholderName: "John Smith",
  expirationMonth: "10",
  expirationYear: "2018",
  cvv: "832",
  billingAddress: {
    postalCode: "94105"
  }
}, function (err, result) {
  if (err) {
    throw new Error('Oh, no!');
  }

  var nonce = result.nonce;
});

Keep in mind that addCreditCard is not documented because it is subject to change!