Card Number Validator API
Validate payment card numbers: Luhn checksum, length, brand (Visa, Mastercard, JCB, Amex, UnionPay, NAPAS…), Vietnamese NAPAS issuing bank and a masked form.
The card check API validates the format of a payment card number before you send it to a payment gateway. It runs the Luhn checksum, detects the brand from the number’s prefix (Visa, Mastercard including the 2-series, American Express, JCB, Discover, Diners Club, UnionPay, Mir, Maestro and NAPAS domestic cards starting with 9704) and checks the length expected for that brand.
For Vietnamese NAPAS cards the issuing bank is read from the 6-digit BIN (970436 → Vietcombank, 970415 → VietinBank…), using the same bank list as the VietQR API. The response also gives the masked number (first 6 and last 4 digits) for display and logs, and the CVC length of the brand.
Format check only: it does not tell whether a card exists, is active or has funds. The number is processed in memory and is never stored, logged or cached. Never send CVC codes or expiry dates. Handling full card numbers on your own servers brings PCI DSS obligations; prefer tokenisation by your payment provider in production.
Parameters
| Name | In | Type | Required | Default | |
|---|---|---|---|---|---|
number | body | string | yes | Card number (spaces and dashes allowed). Use POST. |
Example
curl -X POST "https://apibox.io.vn/v1/card-check" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"number":"9704 3666 1458 1234"}'const res = await fetch('https://apibox.io.vn/v1/card-check', {
method: 'POST',
headers: {
Authorization: 'Bearer YOUR_API_KEY',
'Content-Type': 'application/json',
},
body: JSON.stringify({
"number": "9704 3666 1458 1234"
}),
});
const data = await res.json();
console.log(data);import requests
res = requests.post(
"https://apibox.io.vn/v1/card-check",
headers={"Authorization": "Bearer YOUR_API_KEY"},
json={"number": "9704 3666 1458 1234"},
timeout=30,
)
print(res.json())<?php
$ch = curl_init('https://apibox.io.vn/v1/card-check');
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_CUSTOMREQUEST => 'POST',
CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY', 'Content-Type: application/json'],
CURLOPT_POSTFIELDS => '{"number":"9704 3666 1458 1234"}',
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));Response
{
"valid": true,
"errors": [],
"brand": "NAPAS",
"length": 16,
"luhn": true,
"masked": "970436••••••1234",
"formatted_masked": "9704 36•• •••• 1234",
"bin": "970436",
"cvc_length": null,
"domestic": true,
"issuer": {
"bank": "Vietcombank",
"name": "Ngân hàng TMCP Ngoại thương Việt Nam",
"code": "VCB"
},
"note": "Format check only: …"
}Use cases
- Instant feedback on card fields in checkout forms
- Show the card brand logo while the user types
- Clean imported payment data
- Test payment flows with test card numbers
FAQ
Does a valid result mean the card works?
No. It only means the number is well-formed. Only the card network or your payment provider can authorise it.
Which Vietnamese cards are recognised?
NAPAS domestic debit cards (BIN 9704xx, 16 or 19 digits) with the issuing bank; international Visa / Mastercard / JCB cards issued in Vietnam are detected by brand.
Is it safe to send card numbers?
They are not stored or logged, and responses are not cached. Still, send them only over HTTPS POST, and never send CVC or expiry.
Related APIs
Hash Generator
Compute MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 of text or files in one call, as hex or base64, with optional HMAC signing.
B64Encode / Decode
Encode or decode text as Base64, Base64URL, hex, URL encoding, HTML entities, Unicode escapes, ROT13 or binary with one simple API call.
***Password Generator
Generate cryptographically secure random passwords (4–256 chars, up to 100 at once) or check a password’s strength, entropy and estimated crack time.