How to issue stablecoin-funded cards through an API: a developer's guide

Build vs. buy for stablecoin card issuing, the objects a card issuing API must expose, a step-by-step integration flow, and where KYC and KYB sit in it.

Reading time: about 8 minutes.

Summary: API-based stablecoin card issuing means creating cardholders, cards, and spending decisions through a card issuing provider's REST API, while funding each purchase from a stablecoin balance such as USDC. The provider handles the network connection and the sponsor bank. Your code decides who gets a card, how it is funded, and which transactions to approve.

This guide is for developers and technical founders deciding whether to build or integrate. It covers what each path requires, the objects any issuing API has to expose, and an integration flow you can follow as a checklist.

One note on scope. The endpoints and payloads below are a generic shape shared by most issuing APIs, not one provider's reference. Names change between providers. The objects and their order do not. For the concepts behind the card itself, read what stablecoin card issuing is.

Should you build card issuing in-house or use an API?

Building means becoming the issuer's technology and compliance partner yourself. Buying means integrating one that already is.

RequirementBuild in-houseIntegrate an issuing API
Sponsor bankNegotiate and sign a BIN sponsorship agreementProvided; you are approved under the provider's program
Card networkMeet Visa or Mastercard program and certification requirementsProvided
Card data securityPCI DSS compliance for storing and processing card numbersProvider's vault; you never touch the full card number
Authorization engineBuild or license an issuer processorProvided; you answer a webhook
Compliance programWritten AML program, KYC, monitoring, filings, under the sponsor's oversightShared: the provider runs most checks, you own your program's policies
Disputes and chargebacksBuild dispute operationsProvider workflow plus API events
Time to first cardTypically a year or moreSandbox in a day; production after program approval

Build only if card issuing is the product and you have the capital and patience for bank and network negotiations. Everyone else integrates, and spends the saved time on the ledger and UX, which is where programs actually differ.

What does a stablecoin card issuing API need to expose?

A usable issuing API has seven objects. If a provider is missing one, you will end up building it.

ObjectWhat it doesFields to look for
CardholderThe verified person or business the card belongs toKYC status, country, rejection reasons
Funding sourceThe stablecoin balance that pays for purchasesToken, network, wallet address, custody model
CardA virtual or physical cardStatus, limits, merchant category rules, expiry
Authorization requestA real-time question from the network: approve this?Amount, currency, merchant, MCC, deadline
TransactionThe lifecycle after approvalClearing amount, reversals, refunds, FX rate
DisputeA cardholder challenge to a transactionReason code, deadline, evidence
Webhook endpointWhere events are deliveredSigning secret, retry policy, event types

Two questions separate stablecoin-native providers from traditional ones bolted onto a wallet:

  • When does conversion happen? Just in time at authorization, so balances stay in USDC, or ahead of time into a fiat card balance.
  • Who holds the stablecoins? A custodial program wallet, or your own wallet with an on-chain spending allowance the provider can draw from.

Integration flow, step by step

1. Get sandbox credentials

Sign up, get sandbox keys, and before writing code ask for three lists: supported card currencies, cardholder countries the sponsor bank accepts, and stablecoins and networks the funding source supports. These decide your product more than any endpoint.

2. Pass KYB for your business

The provider and its sponsor bank verify your company before approving the program: registration, beneficial owners, business model, and expected volumes. The approval sets your limits and card types. Plan for this to take longer than the code.

3. Create a cardholder and pass KYC

Bash

The response comes back with a status such as pending. Wait for approved on a webhook before issuing a card. Treat rejected as final and show a clear message.

Bash

In a custodial model you deposit USDC to an address the provider gives you. In an allowance model you approve a spending limit on-chain from your own wallet, and the provider pulls only what settles.

5. Issue a virtual card

Bash

Amounts are in minor units, so 200000 is USD 2,000.00. MCC 7995 is gambling. Show the card number to the cardholder through the provider's embedded, PCI-compliant display component. Never proxy the full card number through your own backend, or you inherit PCI scope.

6. Handle the authorization webhook

This is the heart of the integration. On each purchase the provider calls your endpoint and waits a few seconds for an answer. If you do not answer in time, the provider applies a default decision you configure.

TypeScript

Three rules make this handler reliable:

  • Read from your ledger, not the blockchain. An on-chain balance query is too slow for an authorization deadline. Keep a ledger that updates on deposit and settlement events.
  • Be idempotent. Providers retry. Key on the authorization id and return the same decision.
  • Decide your timeout default deliberately. Decline on timeout is safer. Approve on timeout is friendlier and needs a buffer.

7. Process clearing, reversals, and refunds

The authorized amount is not the final amount. Listen for clearing events and adjust the hold, release holds on reversals, and credit refunds. Post each event to your ledger once, keyed on its id.

8. Settle the funding side

At settlement the provider draws the stablecoins that cover the day's cleared purchases and pays the network, in fiat or in USDC where the network supports it. Reconcile the draw against your ledger daily.

If your treasury starts in a bank account, you need a way into stablecoins first. BlindPay virtual USD accounts accept ACH and wire deposits and convert them to USDC or USDT in a linked wallet, and the stablecoin API integration guide walks through those calls with real endpoints.

9. Go live with low limits

Switch to production keys, issue one card to an internal cardholder with a USD 50 limit, and buy something real. Check every event landed in the ledger. Then raise limits.

Where does KYC and KYB sit in the flow?

Compliance is not a step. It is four checkpoints.

CheckpointCheckWhy it cannot be skipped
Program approvalKYB on your company and its beneficial ownersThe sponsor bank must know who runs the program
Cardholder creationKYC on each cardholder, sanctions screeningA card is an account; account opening requires identification
FundingWallet address screeningStablecoin funds from a sanctioned address taint the program
Every authorizationTransaction monitoring, velocity and merchant rulesThe sponsor bank's AML program covers every transaction on its BIN

The sponsor bank carries the regulatory responsibility for every card on its BIN, and US sanctions compliance is strict liability. A provider that lets you skip a checkpoint is putting its bank relationship, and your program, at risk. The compliance guide covers what each check involves and how it differs by country.

Testing checklist before production

  • Approve, decline for insufficient funds, and decline on a blocked MCC
  • Webhook timeout and the configured default decision
  • Duplicate webhook delivery
  • Partial clearing below the authorized amount, and clearing above it (tips)
  • Full reversal and a refund days later
  • Cardholder KYC rejection
  • Funding source running low mid-month

Finish the series with the compliance guide for stablecoin card issuing. If your recipients need money in a bank account rather than on a card, the stablecoin API integration guide covers local-currency payouts over Pix, SPEI, ACH, SEPA, and SWIFT (POBO/COBO).

This article is for general information only and is not legal, tax, or financial advice.

FAQ