Skip to content

Logo

Token.io

Pay by Bank infrastructure - reimagined

Supports in this guide: Payments

Provider website: token.io


What you need to do for start processing transactions (brief summary)

  1. Get your credentials (from Token.io)
  2. Set your receiving bank account details (Constants)
  3. Connect in Dashboard
  4. Send an API request

Prerequisites: get from Token.io

Contact your Token.io account manager to get your account verified and receive the following credentials.

  • Merchant ID -> Corefy field merchant_id.
  • Member ID -> Corefy field member_id.
  • Key Type -> Corefy field key_type -> one of ED25519, ECDSA_SHA256, RS256, matching the key pair you registered with Token.io.
  • Public Key ID -> Corefy field public_key_id.
  • Private Key -> Corefy field private_key -> uploaded as a file; used to sign every request.
  • Webhook Public Key -> Corefy field webhook_public_key -> used to verify callback notifications from Token.io.

Important

Token.io is an open banking (Pay by Bank) provider - there's no card data involved. Instead, your own receiving bank account details (IBAN, name, and more) must be configured as connection Constants for each payment method before you can accept payments with it - see Constants below.


Payments processing (connect Provider account, create payment-invoice)

Connect Provider account in Corefy Dashboard

Step 1 - Open connection form

Open Token.io in the provider directory and press Connect at Token.io Provider Overview page in the New connection section. Choose Provider account.

Step 2 - Fill in fields and select settings

  • Merchant ID
  • Member ID
  • Key Type
  • Public Key ID
  • Private Key
  • Webhook Public Key
  • Test Mode -> (enable if you are using sandbox credentials)

For each payment method/service you plan to use, fill in your receiving bank account Constants (see below) - Creditor IBAN and Creditor Name are required.

Success

You have connected Token.io Provider account!


First request to Corefy API (MIN)

What it does: creates a payment-invoice and redirects the customer to their own bank (or a provider like Revolut/N26/Wise) to authorize an account-to-account transfer. All methods are EUR only. Depending on the method, fields.iban (the payer's own IBAN) may be required to initiate the transfer.

Payment - MIN

POST /api/payment-invoices

{
  "data": {
    "type": "payment-invoice",
    "attributes": {
      "reference_id": "8e3dbbb0-17af-4c9a-bedb-93bdac6900a2",
      "service": "sepa_transfer_eur_hpp",
      "currency": "EUR",
      "amount": 10
    }
  }
}

This connector also supports sepa_transfer_instant_eur_hpp, revolut_bank_eur_hpp, n26_bank_eur_hpp, wise_eur_hpp, sofortuberweisung_eur_hpp.

Payment - MAX

POST /api/payment-invoices

{
  "data": {
    "type": "payment-invoice",
    "attributes": {
      "reference_id": "6795502c-e27d-4d07-85e0-93245aab9a3f",
      "service": "sepa_transfer_eur_hpp",
      "currency": "EUR",
      "amount": 10,
      "customer": {
        "reference_id": "cus_123",
        "name": "John Smith",
        "address": {
          "country": "DE",
          "city": "Berlin",
          "full_address": "1 Main street",
          "post_code": "10115"
        }
      },
      "fields": {
        "iban": "DE89370400440532013000"
      }
    }
  }
}

Important

customer.name and fields.iban are only forwarded to Token.io as a pair - if either is missing, neither is sent, and Token.io's own hosted flow collects the payer's bank details instead.


Extended request (MAX)

Why add extra fields (typical reasons): - Provide additional customer details for compliance/reconciliation - Positively influence conversion rate - Include optional fields required by your specific flow


Options

  • charge_bearer -> optional, enum (CRED / DEBT / SHAR / SLEV) - who pays the transfer fee: creditor (you), debtor (the customer), shared between both, or per the service level agreement. Configured per payment method/service.

Constants (your receiving bank account)

Unlike most connectors, these Constants aren't fallback values - they're the only way Token.io learns where to send the money, since the API request never carries your own bank details. Configure them once per payment method/service.

Available constants (constant -> meaning)

  • creditor_iban -> required -> your IBAN.
  • creditor_name -> required -> your account/business name as registered with your bank.
  • creditor_bic -> optional -> your bank's BIC/SWIFT code.
  • creditor_ultimate_name -> optional -> ultimate beneficiary name, if different from the account holder.
  • creditor_bank_name -> optional -> your bank's name.
  • creditor_address_line, creditor_street_name, creditor_building_number, creditor_post_code, creditor_town_name, creditor_state, creditor_district, creditor_country -> optional -> your registered business address, broken into parts.

Additional info

  1. Callback routing is automatic - Corefy generates the callback/return URLs per transaction, nothing to configure in Token.io's own back-office.
  2. No refunds and no payouts - this connector does not support refunds or payouts through Corefy.

FAQ / Troubleshooting

  • Connection fails with an invalid key/algorithm error -> verify that Key Type matches the key pair you generated and registered with Token.io, and that the uploaded Private Key corresponds to the Public Key ID
  • Payment fails with no receiving account configured -> make sure Creditor IBAN and Creditor Name constants are set for the specific payment method/service you're using
  • Currency or service is not supported -> confirm allowed methods in your Token.io account and in Corefy - all methods are EUR only

Question

Still looking for help connecting your Token.io account? Please contact our support team!