We need help identifying the cause of a production card-on-file verification failure. A customer successfully generated a card token through the Web Payments SDK, but POST /v2/cards returned HTTP 400:
category: INVALID_REQUEST_ERROR
code: INVALID_CARD_DATA
detail: Invalid card data.
field: source_id
API version: 2026-09-16
Failed request time: October 20, 2026, 16:24:54 UTC.
Our flow calls card.tokenize with intent STORE, customerInitiated true, sellerKeyedIn false, and the customer’s entered name and billing country in billingContact. The resulting token is passed unchanged to CreateCard with a customer ID, internal customer reference and a unique idempotency key. We do not send a separate postal-code override in CreateCard. No purchase charge is submitted by this card-saving flow.
Other CreateCard requests in the same production application succeed. We confirmed that this request belongs to the intended customer and found no subsequent successful card save for that customer in the reviewed logs. We have not replayed the token, retried the card or changed payment settings during diagnosis.
We understand that INVALID_CARD_DATA is deliberately generic. Could an official Square developer-support representative provide a private channel to review the trace and advise whether the required action concerns the cardholder’s entered details, issuer verification/card-on-file support, or our integration?
The trace ID and application/merchant identifiers are available for private follow-up. This public post contains no customer name, contact information, card details, card tokens, credentials or account identifiers.