By the Gpaynow Team · Last reviewed: 8 October 2026
Gpaynow is a virtual card platform for people and businesses who pay online across borders. With a Gpaynow account you can buy prepaid virtual Visa and Mastercard cards, fund your balance with crypto, and get your card details straight in your dashboard — with no KYC needed to buy.
A virtual card issuing API is a different tool: it lets a business create payment cards through code instead of ordering them from a bank one at a time. Your software sends a request, and a card number, expiry date and CVV come back, ready to be shown to a user, attached to a supplier, or used for a single purchase. Behind that one request sits a chain of regulated companies: a sponsor bank, a card network and an issuer processor.
This guide explains how that chain works, what an issuing API actually does at each step, what it costs, which providers offer one, and how to choose. It is written for founders, product managers and developers who are deciding whether to build a card program.
Quick summary
Need a virtual card today?
Skip the integration. Create a free Gpaynow account, top up with crypto and buy a prepaid virtual Visa or Mastercard — no KYC required.
A card issuing API is a set of web requests that let your application create, fund, control and close payment cards. A virtual card exists only as data: a 16-digit card number (PAN), an expiry date and a security code. It can be used anywhere online card payments are accepted, and with some providers it can also be added to a phone wallet for in-store payments.
The API is the interface. The card itself only works because a bank that is a member of a card network issues it under its own BIN (the first digits of the card number). That is why every issuing API provider either is a licensed institution or partners with one.
You can see which bank and country stand behind any card by looking up its first digits with a BIN checker.
When people say "card issuing API", they usually mean a provider that bundles several roles together. Knowing the roles helps you compare providers honestly.
| Role | What it does |
|---|---|
| Card network | Visa or Mastercard. Sets the rules, routes authorisations between merchants and issuers, and settles money between them. |
| Issuing (sponsor) bank | The licensed institution that owns the BIN and is legally the card issuer. It holds the funds or the credit line behind the cards. |
| Issuer processor | The technology that creates card records, receives authorisation requests from the network and returns approve or decline decisions. |
| Program manager | The company that runs the card program day to day: onboarding, compliance checks, customer support and reporting. Sometimes this is the API provider, sometimes it is you. |
| Your application | Calls the API to create cards, sets limits, shows card details to users and reacts to transactions. |
Some providers combine the processor and program-manager roles and bring their own bank partners; others expect you to sign with a sponsor bank yourself. Ask every provider which roles they cover and which they leave to you.
Before you can issue a single live card, the provider and its bank partner will verify your business (KYB): who owns it, what it does and how cards will be used. If your cards go to consumers or other businesses, the program usually also needs identity checks on those cardholders (KYC). Most providers give you a test environment while this happens.
A typical integration first creates a cardholder — the person or company the card belongs to, with a billing address — and then creates a card for that cardholder. You choose the card type (single-use or multi-use), the currency, and any spending limits at creation time. Card details such as the full number and CVV are sensitive, so most providers let you display them through a secure hosted component instead of passing them through your own servers.
Cards need money behind them. Providers generally use one of two models:
Credit-based programs, where the bank extends a credit line, are a third option and usually come with stricter underwriting.
When the card is used, the merchant's request travels through the card network to the issuer processor, which checks the card's balance and rules and returns approve or decline within seconds. Common controls include per-transaction and per-period limits, allowed or blocked merchant categories (MCCs), allowed countries and single-use expiry. Many providers can also send the authorisation request to your own system, so your business logic makes the final decision.
Approved transactions settle a day or more later. The API reports each authorisation, capture, refund and reversal, usually through webhooks (automatic messages to your server) and through list endpoints you can query. Good reconciliation data — merchant name, category, amount, currency and the card it belongs to — is what turns a card program into an accounting tool. You also need a process for disputes and chargebacks; our chargeback vs refund calculator shows why preventing disputes matters for merchants.
| Card type | Best for | Trade-off |
|---|---|---|
| Virtual, multi-use | Subscriptions, software, ad accounts, employee spend | Needs good limits, because it can be charged repeatedly |
| Virtual, single-use | One-off supplier payments, online purchases with fraud risk | Recurring billing will fail once the card closes |
| Physical | In-person spending, travel, field staff | Production and shipping cost, slower to issue |
Most issuing APIs that offer physical cards let you create the virtual card first and ship the plastic later on the same account.
Use this as a checklist when you talk to providers. Not every provider offers every feature, and availability often differs by country.
Card data (PCI DSS). Anyone who stores, processes or transmits full card numbers falls under the PCI Data Security Standard. The simplest way to keep your own scope small is to never receive full card numbers on your servers: use the provider's hosted card-display component and work with card IDs and the last four digits everywhere else.
Know your customer. Card programs sit inside banking rules, so expect identity verification, sanctions screening and transaction monitoring. The bank partner sets the minimum standard; the provider may run the checks for you.
Strong customer authentication. In the UK and EEA, many online card payments require two-factor authentication, usually through 3-D Secure. Cards that can't complete it will be declined at many European checkouts.
Pricing falls into two broad models:
Beyond the per-card fee, budget for: transaction or processing fees, foreign-exchange spreads on cross-currency spend, physical card production and shipping, dispute fees, and the cost of your own compliance work. On the other side of the ledger, issuers earn interchange on card purchases, and some programs share part of it with the business running the program — ask whether that applies to you and in which regions.
Prices change often. Always confirm current pricing on the provider's own site before you commit.
The table below summarises what each provider publicly says it offers, as of October 2026. Check each provider's current documentation before deciding.
| Provider | Model | Where it operates | Notes |
|---|---|---|---|
| Stripe Issuing | Self-serve API, published pricing | US, UK and many EEA countries | Virtual and physical cards; virtual cards $0.10 each in the US |
| Marqeta | Enterprise issuer processor | Certified in 40+ countries | Used by large programs such as Ramp and Expensify; contract-based |
| Lithic | Developer-focused issuing API | US-focused | Offers a sandbox for developers. Confirm pricing directly |
| Highnote | Single API for issuing, KYC/KYB, credit and disputes | US-focused | Visa and Mastercard issuer processor; test environment |
| Adyen Issuing | Issuing for platforms | EEA, UK and US only | Virtual and physical cards |
| Airwallex Issuing | API on top of an Airwallex wallet | Multi-region | Single-use and multi-use Visa cards in multiple currencies |
| Sudo Africa | Issuing API | Africa, including Nigeria | Virtual and physical cards with spending controls |
United States. Only banks and credit unions can issue cards, so every US program runs on a sponsor bank's BIN. Self-serve providers bundle that bank relationship; enterprise processors may ask you to bring one.
UK and EEA. Expect strong customer authentication (3-D Secure) at many online checkouts, and check whether your provider supports multi-currency balances if you spend across borders.
Nigeria and wider Africa. The market has changed quickly. Several consumer "virtual dollar card" services were suspended in 2022 after a card partner stopped issuing, including Flutterwave's. Before you build on any regional provider, confirm that it is actively issuing, which network and BIN it uses, and what happens to cardholder balances if a partner exits.
An issuing API makes sense when you need to create many cards inside your own product. If you just need a card to pay for software, ads, subscriptions or online services, a ready-made virtual card is far simpler: no integration, no card program and no bank partner. That is what Gpaynow offers.
Gpaynow sells prepaid virtual Visa and Mastercard cards that you can buy, fund and use online without building anything. Here is what you get.
Ready to get your card?
Open your free Gpaynow account, add funds with crypto and choose from Visa, Mastercard, Maestro and Mir cards issued in five countries.
Gpaynow cards are prepaid, and some merchants restrict prepaid cards. For example, OpenAI does not accept prepaid cards for API credits. Check the merchant's payment rules before you buy, and start with a small purchase where you can. Gpaynow cards are ready-made cards for your own use; they are not an issuing API for creating cards inside your product.
Do I need a banking license to issue cards through an API?
Usually not. Your provider's sponsor bank is the licensed issuer, and your business runs the program under that bank's rules. You will still have to pass the bank's and provider's checks, and some programs require you to take on compliance work yourself.
How long does it take to launch a card program?
It depends on the provider and your use case. Self-serve providers can let you start building in a test environment straight away, while live approval needs business verification. Enterprise programs with custom contracts commonly take weeks to months.
What is a BIN, and why does it matter?
The BIN (bank identification number) is the first six to eight digits of a card number. It identifies the issuing bank, card type and country. Merchants and fraud systems use it to decide whether to accept a card, so the BIN your provider uses affects where your cards work.
What is the difference between prepaid, debit and credit virtual cards?
A prepaid card spends a balance loaded in advance. A debit card spends money from an account. A credit card spends against a credit line that is repaid later. Some merchants treat them differently — for example, OpenAI does not accept prepaid cards for API credits.
Can virtual cards be added to Apple Pay or Google Pay?
With some providers, yes. Digital-wallet provisioning depends on the provider, the bank partner and the country, so check it before you rely on it.
Are virtual cards safer than physical cards?
They can be. Because you can create a separate card for each vendor or purchase, set tight limits and close a card instantly, a leaked card number usually causes less damage. Security still depends on how the card details are stored and shown.