Customers

List a shopper's saved cards

Return the cards the signed-in shopper has saved for Subscribe & Save deliveries, newest first. Each card shows its brand, last four digits and expiry; the card number and the processor’s references are never returned. Removed and replaced cards are not listed.

Customer-self access. Works with a publishable key (safe from the browser). Provide the shopper’s session token in the x-auth-token header (or the store’s bring-your-own-auth assertion in x-external-auth); it must resolve to the customer in the {id} path parameter, otherwise the request returns 403. A subscription that belongs to another shopper reads as 404.

GET

customers

{id}

payment-methods

List a shopper's saved cards

curl --request GET \
  --url https://api.tybritelabs.com/v1/customers/{id}/payment-methods \
  --header 'Authorization: Bearer <token>' \
  --header 'x-auth-token: <x-auth-token>'

import requests

url = "https://api.tybritelabs.com/v1/customers/{id}/payment-methods"

headers = {
    "x-auth-token": "<x-auth-token>",
    "Authorization": "Bearer <token>"
}

response = requests.get(url, headers=headers)

print(response.text)

const options = {
  method: 'GET',
  headers: {'x-auth-token': '<x-auth-token>', Authorization: 'Bearer <token>'}
};

fetch('https://api.tybritelabs.com/v1/customers/{id}/payment-methods', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tybritelabs.com/v1/customers/{id}/payment-methods",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "x-auth-token: <x-auth-token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tybritelabs.com/v1/customers/{id}/payment-methods"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-auth-token", "<x-auth-token>")
	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.get("https://api.tybritelabs.com/v1/customers/{id}/payment-methods")
  .header("x-auth-token", "<x-auth-token>")
  .header("Authorization", "Bearer <token>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.tybritelabs.com/v1/customers/{id}/payment-methods")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["x-auth-token"] = '<x-auth-token>'
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "payment_methods": [
    {
      "id": "5a0e2d7c-91b4-4c3a-8e6f-1d2b3c4a5e60",
      "processor": "stripe",
      "brand": "visa",
      "last4": "4242",
      "exp_month": 12,
      "exp_year": 2028,
      "status": "active",
      "created_at": "2026-08-28T09:31:12+00:00"
    }
  ]
}

Authorizations

Authorization

string

header

required

API Key Authentication

Use your API key in the Authorization header:

Authorization: Bearer tybrite_sk_live_YOUR_KEY

Key Types:

Secret Keys (Server-Side Only):

Format: tybrite_sk_live_* (production) or tybrite_sk_test_* (sandbox)
Full read/write access to all endpoints
⚠️ NEVER expose in client-side code or public repositories
Required for: every write a shopper does not make for themselves, authentication, payment verification, AI recommendations

Publishable Keys (Client-Safe):

Format: tybrite_pk_live_* (production) or tybrite_pk_test_* (sandbox)
Catalogue reads, plus the actions a shopper takes for themselves
✅ Safe for client-side JavaScript, mobile apps, and public code
Allowed for: browsing products, search, CMS content, pricing queries, cart and wishlist, reviews, storefront events, and the Agent API's quotes, cart drafts and checkout intents

Endpoint-Specific Requirements:

Authentication endpoints (/v1/auth/*): Secret key required
Payment verification (POST /v1/payments/verify): Secret key required
AI Recommendations (POST /v1/recommendations): Secret key required
Semantic Search (POST /v1/search): Both key types allowed (read-only operation)
Shopper actions (cart, wishlist, reviews, storefront events, Agent API quotes, cart drafts and checkout intents): Both key types allowed
All other write operations: Secret key required
All read operations: Both key types allowed

Using a publishable key for restricted operations returns 403 Forbidden.

Headers

x-auth-token

string

required

The signed-in shopper's session token, obtained when the shopper logs in. Must resolve to the customer in the {id} path parameter.

x-external-auth

string

Bring-your-own-auth assertion for stores that manage authentication in an external identity provider (Auth0, Clerk, Cognito, Firebase, NextAuth, SSO). Resolves the shopper whose saved cards are managed.

Format: <base64url(JSON)>.<base64url(HMAC-SHA256(JSON))> where the JSON is { "external_id": "...", "iat": <unix>, "exp": <unix> } and the HMAC is keyed on the store's hmac_secret. Claim lifetime capped at 300 seconds. Provide exactly one of x-auth-token, x-external-auth, or x-idp-token.

x-idp-token

string

A raw token from the store's own identity provider (e.g. a Firebase ID token). Galactic Core forwards it to the store's configured Auth verifier, which validates it against the provider and returns the identity; resolves the shopper whose saved cards are managed.

Use this when the store wants Galactic Core to verify tokens on its behalf rather than signing an assertion itself. Verification is fail-closed: if the verifier rejects the token or is unreachable, the request is unauthenticated (401). Requires an Auth verifier to be configured for the store. Provide exactly one of x-auth-token, x-external-auth, or x-idp-token.

Path Parameters

string<uuid>

required

The shopper's customer id.

Response

The shopper's saved cards.

payment_methods

object[]

required

Show child attributes

List a shopper's saved cards

curl --request GET \
  --url https://api.tybritelabs.com/v1/customers/{id}/payment-methods \
  --header 'Authorization: Bearer <token>' \
  --header 'x-auth-token: <x-auth-token>'

import requests

url = "https://api.tybritelabs.com/v1/customers/{id}/payment-methods"

headers = {
    "x-auth-token": "<x-auth-token>",
    "Authorization": "Bearer <token>"
}

response = requests.get(url, headers=headers)

print(response.text)

const options = {
  method: 'GET',
  headers: {'x-auth-token': '<x-auth-token>', Authorization: 'Bearer <token>'}
};

fetch('https://api.tybritelabs.com/v1/customers/{id}/payment-methods', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tybritelabs.com/v1/customers/{id}/payment-methods",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "x-auth-token: <x-auth-token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tybritelabs.com/v1/customers/{id}/payment-methods"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-auth-token", "<x-auth-token>")
	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.get("https://api.tybritelabs.com/v1/customers/{id}/payment-methods")
  .header("x-auth-token", "<x-auth-token>")
  .header("Authorization", "Bearer <token>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.tybritelabs.com/v1/customers/{id}/payment-methods")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["x-auth-token"] = '<x-auth-token>'
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "payment_methods": [
    {
      "id": "5a0e2d7c-91b4-4c3a-8e6f-1d2b3c4a5e60",
      "processor": "stripe",
      "brand": "visa",
      "last4": "4242",
      "exp_month": 12,
      "exp_year": 2028,
      "status": "active",
      "created_at": "2026-08-28T09:31:12+00:00"
    }
  ]
}

Reference

System

Store

Products

Taxonomy

Orders

Payments

Cart & Wishlist

Marketplace

Recommendations

Discovery

Events

Tax

Analytics

Agent

Search

Authentication

Customers

Gift Cards

Promotions

Campaigns

CMS

Pricing

Messaging

Shipping

GC Connect

Reviews

Returns

Disputes

B2B

Webhooks

Ingestion

Feeds

Sandbox

List a shopper's saved cards

Authorizations

Headers

Path Parameters

Response