Customers

Remove a saved card

Remove one of the signed-in shopper’s saved cards. The store can no longer charge it. A subscription that was charging this card switches to confirm-and-pay: the shopper is sent a link to pay each delivery until a new card is added.

Customer-self access. Works with a publishable key (safe from the browser). Provide the shopper’s session token in the x-auth-token header (or the store’s bring-your-own-auth assertion in x-external-auth); it must resolve to the customer in the {id} path parameter, otherwise the request returns 403. A subscription that belongs to another shopper reads as 404.

DELETE

customers

{id}

payment-methods

{paymentMethodId}

Remove a saved card

curl --request DELETE \
  --url https://api.tybritelabs.com/v1/customers/{id}/payment-methods/{paymentMethodId} \
  --header 'Authorization: Bearer <token>' \
  --header 'x-auth-token: <x-auth-token>'

import requests

url = "https://api.tybritelabs.com/v1/customers/{id}/payment-methods/{paymentMethodId}"

headers = {
    "x-auth-token": "<x-auth-token>",
    "Authorization": "Bearer <token>"
}

response = requests.delete(url, headers=headers)

print(response.text)

const options = {
  method: 'DELETE',
  headers: {'x-auth-token': '<x-auth-token>', Authorization: 'Bearer <token>'}
};

fetch('https://api.tybritelabs.com/v1/customers/{id}/payment-methods/{paymentMethodId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tybritelabs.com/v1/customers/{id}/payment-methods/{paymentMethodId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "DELETE",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "x-auth-token: <x-auth-token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tybritelabs.com/v1/customers/{id}/payment-methods/{paymentMethodId}"

	req, _ := http.NewRequest("DELETE", url, nil)

	req.Header.Add("x-auth-token", "<x-auth-token>")
	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.delete("https://api.tybritelabs.com/v1/customers/{id}/payment-methods/{paymentMethodId}")
  .header("x-auth-token", "<x-auth-token>")
  .header("Authorization", "Bearer <token>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.tybritelabs.com/v1/customers/{id}/payment-methods/{paymentMethodId}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Delete.new(url)
request["x-auth-token"] = '<x-auth-token>'
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "success": true,
  "message": "Saved card removed"
}

Authorizations

Authorization

string

header

required

API Key Authentication

Use your API key in the Authorization header:

Authorization: Bearer tybrite_sk_live_YOUR_KEY

Key Types:

Secret Keys (Server-Side Only):

Format: tybrite_sk_live_* (production) or tybrite_sk_test_* (sandbox)
Full read/write access to all endpoints
⚠️ NEVER expose in client-side code or public repositories
Required for: every write a shopper does not make for themselves, authentication, payment verification, AI recommendations

Publishable Keys (Client-Safe):

Format: tybrite_pk_live_* (production) or tybrite_pk_test_* (sandbox)
Catalogue reads, plus the actions a shopper takes for themselves
✅ Safe for client-side JavaScript, mobile apps, and public code
Allowed for: browsing products, search, CMS content, pricing queries, cart and wishlist, reviews, storefront events, and the Agent API's quotes, cart drafts and checkout intents

Endpoint-Specific Requirements:

Authentication endpoints (/v1/auth/*): Secret key required
Payment verification (POST /v1/payments/verify): Secret key required
AI Recommendations (POST /v1/recommendations): Secret key required
Semantic Search (POST /v1/search): Both key types allowed (read-only operation)
Shopper actions (cart, wishlist, reviews, storefront events, Agent API quotes, cart drafts and checkout intents): Both key types allowed
All other write operations: Secret key required
All read operations: Both key types allowed

Using a publishable key for restricted operations returns 403 Forbidden.

Headers

x-auth-token

string

required

The signed-in shopper's session token, obtained when the shopper logs in. Must resolve to the customer in the {id} path parameter.

x-external-auth

string

Bring-your-own-auth assertion for stores that manage authentication in an external identity provider (Auth0, Clerk, Cognito, Firebase, NextAuth, SSO). Resolves the shopper whose saved cards are managed.

Format: <base64url(JSON)>.<base64url(HMAC-SHA256(JSON))> where the JSON is { "external_id": "...", "iat": <unix>, "exp": <unix> } and the HMAC is keyed on the store's hmac_secret. Claim lifetime capped at 300 seconds. Provide exactly one of x-auth-token, x-external-auth, or x-idp-token.

x-idp-token

string

A raw token from the store's own identity provider (e.g. a Firebase ID token). Galactic Core forwards it to the store's configured Auth verifier, which validates it against the provider and returns the identity; resolves the shopper whose saved cards are managed.

Use this when the store wants Galactic Core to verify tokens on its behalf rather than signing an assertion itself. Verification is fail-closed: if the verifier rejects the token or is unreachable, the request is unauthenticated (401). Requires an Auth verifier to be configured for the store. Provide exactly one of x-auth-token, x-external-auth, or x-idp-token.

Path Parameters

string<uuid>

required

The shopper's customer id.

paymentMethodId

string<uuid>

required

The id of the saved card.

Response

The card was removed.

success

boolean

required

Example:

true

message

string

required

Example:

"Saved card removed"

Remove a saved card

curl --request DELETE \
  --url https://api.tybritelabs.com/v1/customers/{id}/payment-methods/{paymentMethodId} \
  --header 'Authorization: Bearer <token>' \
  --header 'x-auth-token: <x-auth-token>'

import requests

url = "https://api.tybritelabs.com/v1/customers/{id}/payment-methods/{paymentMethodId}"

headers = {
    "x-auth-token": "<x-auth-token>",
    "Authorization": "Bearer <token>"
}

response = requests.delete(url, headers=headers)

print(response.text)

const options = {
  method: 'DELETE',
  headers: {'x-auth-token': '<x-auth-token>', Authorization: 'Bearer <token>'}
};

fetch('https://api.tybritelabs.com/v1/customers/{id}/payment-methods/{paymentMethodId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tybritelabs.com/v1/customers/{id}/payment-methods/{paymentMethodId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "DELETE",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "x-auth-token: <x-auth-token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tybritelabs.com/v1/customers/{id}/payment-methods/{paymentMethodId}"

	req, _ := http.NewRequest("DELETE", url, nil)

	req.Header.Add("x-auth-token", "<x-auth-token>")
	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.delete("https://api.tybritelabs.com/v1/customers/{id}/payment-methods/{paymentMethodId}")
  .header("x-auth-token", "<x-auth-token>")
  .header("Authorization", "Bearer <token>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.tybritelabs.com/v1/customers/{id}/payment-methods/{paymentMethodId}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Delete.new(url)
request["x-auth-token"] = '<x-auth-token>'
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "success": true,
  "message": "Saved card removed"
}

Reference

System

Store

Products

Taxonomy

Orders

Payments

Cart & Wishlist

Marketplace

Recommendations

Discovery

Events

Tax

Analytics

Agent

Search

Authentication

Customers

Gift Cards

Promotions

Campaigns

CMS

Pricing

Messaging

Shipping

GC Connect

Reviews

Returns

Disputes

B2B

Webhooks

Ingestion

Feeds

Sandbox

Remove a saved card

Authorizations

Headers

Path Parameters

Response