# CreateCard INVALID\_CARD\_DATA after successful Web Payments SDK tokenization — request for private trace review

**URL:** <https://developer.squareup.com/forums/t/createcard-invalid-card-data-after-successful-web-payments-sdk-tokenization-request-for-private-trace-review/28292>\
**Category:** Questions\
**Tags:** cards-api\
**Created:** [October 22, 2026, 1:53am UTC](https://developer.squareup.com/forums/t/createcard-invalid-card-data-after-successful-web-payments-sdk-tokenization-request-for-private-trace-review/28292 "2026-10-22T01:53:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![PKLCTY](https://avatars.discourse-cdn.com/v4/letter/p/4af34b/32.png) [@PKLCTY](https://developer.squareup.com/forums/u/PKLCTY)\
**Post date:** [October 22, 2026, 1:53am UTC](https://developer.squareup.com/forums/t/createcard-invalid-card-data-after-successful-web-payments-sdk-tokenization-request-for-private-trace-review/28292/1 "2026-10-22T01:53:13Z")

</div>

We need help identifying the cause of a production card-on-file verification failure. A customer successfully generated a card token through the Web Payments SDK, but POST /v2/cards returned HTTP 400:

category: INVALID\_REQUEST\_ERROR  
code: INVALID\_CARD\_DATA  
detail: Invalid card data.  
field: source\_id

API version: 2026-09-16  
Failed request time: October 20, 2026, 16:24:54 UTC.

Our flow calls card.tokenize with intent STORE, customerInitiated true, sellerKeyedIn false, and the customer’s entered name and billing country in billingContact. The resulting token is passed unchanged to CreateCard with a customer ID, internal customer reference and a unique idempotency key. We do not send a separate postal-code override in CreateCard. No purchase charge is submitted by this card-saving flow.

Other CreateCard requests in the same production application succeed. We confirmed that this request belongs to the intended customer and found no subsequent successful card save for that customer in the reviewed logs. We have not replayed the token, retried the card or changed payment settings during diagnosis.

We understand that INVALID\_CARD\_DATA is deliberately generic. Could an official Square developer-support representative provide a private channel to review the trace and advise whether the required action concerns the cardholder’s entered details, issuer verification/card-on-file support, or our integration?

The trace ID and application/merchant identifiers are available for private follow-up. This public post contains no customer name, contact information, card details, card tokens, credentials or account identifiers.

---

<div class="post-metadata">

**Author:** ![ashley-square](https://avatars.discourse-cdn.com/v4/letter/a/5f9b8f/32.png) [@ashley-square](https://developer.squareup.com/forums/u/ashley-square)\
**Post date:** [October 22, 2026, 6:40pm UTC](https://developer.squareup.com/forums/t/createcard-invalid-card-data-after-successful-web-payments-sdk-tokenization-request-for-private-trace-review/28292/3 "2026-10-22T18:40:18Z")

</div>

Sending you a DM for more info