Card validation API (Luhn + brand)
Validates card numbers via Luhn + IIN prefix and detects the brand. Responses contain only masked/last4 — never the raw PAN. No authorization or existence checks.
Endpoint
| Method | Path |
|---|---|
GET | /api/v1/card/validate |
Example
curl "https://formfit.dev/api/v1/card/validate?number=4242424242424242" \
-H "Authorization: Bearer YOUR_API_KEY"
Response (excerpt)
{"valid":true,"brand":"visa","last4":"4242","masked":"•••• •••• •••• 4242"}
FAQ
- Is the card number stored?
- No — the raw PAN is never echoed or logged; validation is pure in-worker logic.