> ## Documentation Index
> Fetch the complete documentation index at: https://crossmint-devin-1787949784-wallet-docs-two-concept-model.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Retrieve Secure Card Numbers

> Mint a secure card credential from an active order-intent rail

Mint a credential for a specific amount and merchant from an order intent. Choose one rail from the order-intent response and use that same rail for verification and credential minting.

## Prerequisites

* **Verified order intent** — follow [Create an Agent Card](/agents/payment-methods/cards/create-agent-card) and wait for a rail with `status: "active"`.
* **Crossmint API key** — a client-side key with `order-intents.read` and `order-intents.credentials` scopes. In staging, all scopes are included by default.
* **User JWT** — use the JWT for the user who owns the order intent.

## Mint a Credential

Find the rail you want to use and confirm that it is active and supports card credentials. Other rails can remain pending. Send the selected rail's `rail` and `provider` values back in the request.

This example continues from the merchant-scoped order intent created in the previous guide, so the credential request does not repeat the merchant:

```typescript theme={null}
const CROSSMINT_CLIENT_API_KEY = "YOUR_CROSSMINT_CLIENT_API_KEY";
const jwt = "YOUR_USER_JWT";
const orderIntentId = "a1b2c3d4-e5f6-4890-abcd-ef1234567890";

const orderIntentResponse = await fetch(
    `https://staging.crossmint.com/api/unstable/order-intents/${orderIntentId}`,
    {
        headers: {
            "X-API-KEY": CROSSMINT_CLIENT_API_KEY,
            Authorization: `Bearer ${jwt}`,
        },
    }
);

if (!orderIntentResponse.ok) {
    throw new Error(`Order intent retrieval failed (${orderIntentResponse.status})`);
}

const orderIntent = await orderIntentResponse.json();

const selectedRail = orderIntent.rails.find(
    (rail) => rail.status === "active" && rail.credentialFormats.includes("card")
);

if (selectedRail == null) {
    throw new Error("No active rail supports card credentials");
}

const response = await fetch(
    `https://staging.crossmint.com/api/unstable/order-intents/${orderIntent.orderIntentId}/credentials`,
    {
        method: "POST",
        headers: {
            "Content-Type": "application/json",
            "X-API-KEY": CROSSMINT_CLIENT_API_KEY,
            Authorization: `Bearer ${jwt}`,
        },
        body: JSON.stringify({
            rail: selectedRail.rail,
            provider: selectedRail.provider,
            amount: { value: "25.00", currency: orderIntent.amount.currency },
            credential: { format: "card" },
        }),
    }
);

if (!response.ok) {
    throw new Error(`Credential creation failed (${response.status})`);
}

const result = await response.json();
```

### Open Order Intents

If `orderIntent.merchant` is absent, include a merchant in every credential request:

```typescript theme={null}
merchant: {
    name: "Acme Store",
    url: "https://acme.example.com",
    countryCode: "US",
},
```

The response returns the selected rail and the credential value. An inactive status on another rail does not affect this request:

```json theme={null}
{
    "id": "cred_123",
    "rail": "agentic-token",
    "provider": "vic",
    "amount": { "value": "25.00", "currency": "USD" },
    "credential": {
        "format": "card",
        "value": {
            "number": "4000001000004242",
            "expirationMonth": 12,
            "expirationYear": 2030,
            "cvc": "123"
        }
    },
    "expiresAt": "2099-01-01T00:05:00.000Z"
}
```

Treat the credential as a secret. Use it immediately, never log it, and do not persist it for later reuse. Minting deducts the requested amount from the order intent even if the credential is never used.

For the complete schema, see the [Create Order Intent Credential API Reference](/api-reference/agentic-commerce/order-intents/get-order-intent-credentials).

## List Order Intents

List every order intent owned by the authenticated user:

```typescript theme={null}
const CROSSMINT_CLIENT_API_KEY = "YOUR_CROSSMINT_CLIENT_API_KEY";
const jwt = "YOUR_USER_JWT";

const response = await fetch("https://staging.crossmint.com/api/unstable/order-intents", {
    headers: {
        "X-API-KEY": CROSSMINT_CLIENT_API_KEY,
        Authorization: `Bearer ${jwt}`,
    },
});

if (!response.ok) {
    throw new Error(`Order intent listing failed (${response.status})`);
}

const orderIntents = await response.json();
```

Each item includes its live balance and rails. Use `GET /api/unstable/order-intents/{orderIntentId}` when you only need to refresh one order intent.

## Common Gotchas

<AccordionGroup>
  <Accordion title="The request amount must fit the available balance">
    Use the same currency as the order intent and keep the requested value at or below `amount.available`.
  </Accordion>

  <Accordion title="Creating a credential spends allowance capacity">
    Do not retry a credential request blindly. Each successful mint is a new credential and consumes the requested amount.
  </Accordion>

  <Accordion title="A pending rail cannot mint credentials">
    Complete allowance verification for the rail you selected and fetch the order intent again before minting. You do not need to verify unrelated rails.
  </Accordion>

  <Accordion title="Open order intents require a merchant">
    If the order intent was created without `merchant`, include one in every credential request. If the merchant was set at creation, omit it when minting.
  </Accordion>
</AccordionGroup>

## Next Steps

<CardGroup cols={2}>
  <Card title="Cancel Card Access" icon="trash" href="/agents/payment-methods/cards/remove-cards">
    Cancel an order intent or delete a saved card
  </Card>

  <Card title="Cards Quickstart" icon="credit-card" href="/agents/cards-quickstart">
    Run the complete flow in the reference app
  </Card>
</CardGroup>