New · Instant Pix in Brazil
sparkio
Start now

Accept · SparkVault

Save the card once. Use it everywhere.

Shoppers type their card one time. It goes straight into SparkVault, never to your servers, and comes back as one token your store, subscriptions, payment links and apps all share — kept current when the bank reissues it.

Start nowTalk to sales
SparkVaultcus_3Kp8Wm · Maya Chen

Simulated diagram. Maya types her Visa card ending 4242 into Northlight's checkout. The number goes straight to SparkVault, which returns the token pm_4Wc7Hn to Northlight's server; the server never receives the card number. Visa issues a network token. The same saved card then pays a one-click return checkout, a Desk Refill Club renewal, a payment link and an order in the Northlight iOS app. Later the bank reissues the card with a new expiry, 12/28, and the account updater changes it in SparkVault without Maya doing anything.

Tue, Oct 13Updated silently. Every channel keeps working — Maya did nothing.

Simulated — no real card data. Tap a channel to replay its charge.

For your team

Every saved card, in one place.

Each customer has one record with every method they saved, where it is used and when the networks last refreshed it. A card added twice is caught by its fingerprint before it clutters the list.

  • Saved methods per customer, across store, app and links
  • Network token and account-updater status on every card
  • Fingerprints catch duplicates and cards shared across customers
  • Remove a card or change the default without code
Read the customers API
SparkVault · Customerscus_3Kp8Wm

Simulated SparkVault dashboard of Northlight for Maya Chen (cus_3Kp8Wm): two saved methods. Visa ending 4242, the default, expires 12/28, has an active network token and was updated by the account updater on Tue, Oct 13; it is used in the store, Club renewals, payment links and the iOS app, and last paid a one-click return order (#20352, Desk Clock, $89.00) on Tue, Oct 20. Apple Pay on her iPhone is used in the iOS app. A card added again from the Saved cards page matched the Visa's fingerprint and was not saved twice.

Maya Chen

[email protected] · Portland, OR

Visa •••• 4242

pm_4Wc7Hn
Network token
Active · •••• 7316
Fingerprint
fp_9Lx2Qa
Added
Mar 14 · checkout
Updated
Oct 13 · updater10/26 → 12/28

Used in

  • Store
  • Club
  • Links
  • iOS app
Last payment · Oct 20pay_1QyY9w$89.00
Simulated data

For your customers

One tap to pay again. Their cards, their call.

Returning shoppers are recognized by email, confirm with a passkey or a one-time code, and pay with the card they saved. A Saved cards page lets them add, remove or change the default without writing to support.

  • Recognized by email, verified with a passkey or a code
  • The default card preselected, no number or CVC to type
  • Saved cards page: add, remove, set default
  • The same cards in your store, links and app
See the checkout
Customer viewpay.sparkio.site/northlight
Screen

Simulated Northlight checkout on a phone, hosted by SparkIO. Maya Chen types her email, is recognized, confirms with a passkey (Face ID), and pays $56.00 for Ceramic Mug × 2 with her saved Visa ending 4242 — no card number and no CVC typed.

Verify with

Network tokens & account updater

Cards that keep working after they change.

Every saved card is enrolled for a network token where the card network offers one. When a bank reissues a card, the network updates the token and the account updater refreshes the rest — before your next charge, without asking the customer.

  • Network tokens requested for every saved card that supports them
  • Card networks report higher approval rates for tokenized payments
  • New expiry dates and numbers applied before the next charge
  • The payment method id never changes, so your code does not either
How subscriptions renew
Card lifecyclepm_4Wc7Hn · Visa •••• 4242
Account updater

Timeline of Maya's saved Visa. Saved Sat, Mar 14 with a network token; renewals paid on it. On Mon, Oct 12 the bank reissued the card with a new expiry; on Tue, Oct 13 the network token and the card on file were updated to 12/28, so the Wed, Oct 14 renewal was paid and the Sat, Nov 14 renewal is scheduled on the new card.

  1. Sat, Mar 14Card saved · network token issuedActive

    Visa •••• 4242 · expires 10/26 · token •••• 7316

  2. Fri, Aug 14Desk Refill Club renewalPaid

    $18.00 · charged on the network tokenpay_1Qr8Bn

  3. Mon, Oct 12The bank reissues the cardReissued

    Same number, new expiry 12/28 · old card valid to Oct 31

  4. Tue, Oct 13 · 03:12Network token and card on file updatedUpdated

    Expiry 10/26 → 12/28 · no email, no form

  5. Wed, Oct 14Desk Refill Club renewalPaid

    $18.00 · on the updated cardpay_1Qy4Nc

  6. Sat, Oct 31The old card expiresNo effect

    Nothing to do — SparkVault already holds 12/28

  7. Sat, Nov 14Next renewalScheduled

    $18.00 · will charge the card expiring 12/28

Maya never had to update her card.

PCI scope

Card numbers never touch your servers.

The card fields are served by SparkVault inside your checkout, so the number goes from the shopper's browser straight to us. Your systems only ever hold tokens, which keeps you eligible for the shortest self-assessment questionnaire, SAQ A.

  • Fields hosted by SparkVault in an isolated frame
  • Your server receives a pm_ id, brand, last four and expiry
  • Eligible for SAQ A with hosted or embedded fields
  • SparkVault built to PCI DSS Level 1 — target, not yet assessed
Read about security
PCI scopeNorthlight Goods LLC
Integration

Hosted page: the shopper types the card on a page served by SparkIO; the number goes to SparkVault, and Northlight's server receives only the token pm_4Wc7Hn with brand, last four, expiry and fingerprint. Northlight is eligible for SAQ A.

Your self-assessment

SAQ A

Eligible — the shortest questionnaire.

What reaches your serverPOST /orders

{  "payment_method": "pm_4Wc7Hn",  "brand": "visa", "last4": "4242",  "exp": "12/28",  "fingerprint": "fp_9Lx2Qa"}

Enough to show the card. Useless anywhere else.

Our sidePCI DSS Level 1Target

PCI DSS Level 1: target, not yet assessed. Simulated payloads.

Portability

Bring your cards. Take them with you.

Import saved cards from your current provider through an encrypted transfer between PCI-compliant vaults, or export them to another one whenever you ask. Your customers never re-enter a card, and you are never locked in.

  • Encrypted PCI-to-PCI transfer, no file passes through you
  • Ids mapped one to one, so subscriptions keep renewing
  • Duplicates merged by fingerprint on the way in
  • Export on request to any PCI DSS–compliant provider
Talk to us about a migration
SparkVault · Migrationsimp_2Rk7Wd
Direction

Import from your previous provider

Started Mon, Mar 2 · encrypted file

Done
2,416 cards100%
  1. Encrypted file receivedPGP · sent provider to provider
  2. Decrypted inside SparkVaultNumbers never leave it
  3. Validated2,398 ready · 18 expired → account updater
  4. Duplicates merged9 by fingerprint
  5. Ids mapped one to one2,407 rows · mapping.csv
  6. Network tokens requested2,389 cards
Customers never re-enter a card.

Developers

Save it now. Charge it later.

Attach the payment method from checkout to a customer, then charge it whenever you need to — with the shopper present, or off-session for renewals and reorders.

  • The browser tokenizes; your server only handles pm_ ids
  • Attach to a customer in one call
  • off_session: true for renewals and merchant-initiated charges
  • Webhooks when a saved card is updated or removed
Read the API reference
SparkVault APIPOST /v1/payment_methods/pm_4Wc7Hn/attach
import SparkIO from "sparkio";const sparkio = new SparkIO(process.env.SPARKIO_SECRET_KEY);// The checkout fields tokenized the card in the browser;// your server only ever sees "pm_4Wc7Hn".const method = await sparkio.paymentMethods.attach(  "pm_4Wc7Hn",  { customer: "cus_3Kp8Wm" },);
Response200 OK
{  "id": "pm_4Wc7Hn",  "customer": "cus_3Kp8Wm",  "card": { "brand": "visa", "last4": "4242",            "fingerprint": "fp_9Lx2Qa" },  "network_token": "active"}

Also in SparkVault

The details that keep it safe.

Controls you would otherwise build yourself, on from the first saved card.

  • 3-D Secure on first use

    The payment that saves a card can be authenticated once, so later charges you start carry that authentication where rules like SCA ask for it.

  • Card fingerprinting

    Each card gets a fingerprint that stays the same across customers, so duplicates, shared cards and repeat fraud stand out without anyone seeing the number.

  • One vault, every channel

    Your store, your apps and your payment links read the same vault: a card saved in one works in all of them.

  • Encryption at rest

    Card numbers are encrypted with AES-256, and the keys are held in hardware security modules, apart from the data they protect.

  • Role-based access

    Decide who can view customers, remove cards or request an export. No role, including yours, can see a full card number.

  • Audit log

    Every view, change, import and export is recorded with who, when and from where, and kept for your records.

Questions

Questions about SparkVault.

Do you ever see the full card number?
No. The card fields are served by SparkVault inside your checkout, so the number travels from the shopper's browser straight to SparkIO. Your server receives a payment method id with the brand, last four, expiry and fingerprint — enough to show the card, never enough to charge it anywhere else.
What is the difference between a SparkVault token and a network token?
The SparkVault token (pm_…) is the id you store and send to our API; it only works with your account. A network token is issued by the card network to stand in for the card number inside the authorization itself. We request one for every saved card where the network offers it and use it automatically.
How does the account updater work?
When a bank reissues a card, the network shares the new expiry or number. Network tokens update on their own; for cards without one, we check the networks' updater services before charging. The payment method id never changes, so nothing in your code or in your customer's account has to.
Can I import cards from my current provider?
Yes. Your current provider sends an encrypted file straight to SparkVault — a transfer between PCI-compliant providers that never passes through you. Each card gets a new payment method id, duplicates are merged by fingerprint, and you receive the mapping so subscriptions keep renewing.
Can I take my cards with me if I leave?
Yes. Request an export and we send your saved cards, encrypted, to any provider with a valid PCI DSS attestation. The cards belong to your business, not to us.
Do saved cards need 3-D Secure?
Where strong customer authentication applies — in the EEA and the UK, for example — the payment that saves the card is authenticated once. Later charges you start, such as renewals, are flagged as merchant-initiated and usually go through without a new challenge.

Keep the card. Keep the customer.

Sandbox keys now, live keys after verification. SparkVault is on from your first payment — nothing to switch on.

Start nowTalk to sales