Card Authorizations

Card authorizations let you securely collect a client's credit card information through an encrypted form. Once authorized, you can charge the card and the payment is automatically recorded.

Creating a Card Authorization

From a trip's payment section, create a new card authorization by specifying:

• Traveler — which traveler this card auth is for
• Amount and currency — the authorization amount
• Access duration — how long the authorization is valid (default: 30 days)

This generates a unique, shareable link.

Sending the Link to Your Client

Share the card authorization link with your traveler. They'll see a secure form asking for:

• Cardholder name
• Billing address
• Card details (number, expiration, CVC)
• An authorization agreement checkbox

All card data is encrypted by Evervault before it leaves the browser — your agency never sees or stores raw card numbers.

Once the traveler submits:

1. The card is automatically charged for the authorized amount
2. A payment record is created and linked to the invoice
3. The invoice status updates to paid (or partially paid for split payments)
4. You receive an email confirming the charge with the amount, cardholder name, and last 4 digits

You don't need to do anything for the happy path. The only time you need to intervene is if a charge is declined or needs to be voided.

Card Authorization Statuses

Status	What it means
Pending	Created but the traveler hasn't submitted yet
Authorized	Card details collected and ready to charge
Charged	Card has been charged
Declined	Card was declined during charging
Expired	Authorization window has passed
Revoked	You manually cancelled the authorization

Auto-Charge Behavior

Cards are automatically charged when the client submits the authorization form. This eliminates a manual step for you — no need to click "Mark as Charged" in most cases.

If you need to manually charge (e.g., the auto-charge didn't apply or you want to charge a different amount), click Mark as Charged. The system won't double-charge — if a payment already exists, it will show the existing record.

If the card is declined, click Mark as Declined — no payment record is created.

Revoking an Authorization

You can revoke any pending or authorized card auth at any time. This immediately destroys the encrypted card data and prevents future charges.

Security & Compliance

• Card data is encrypted client-side by Evervault (PCI DSS Level 1 compliant)
• Encrypted data is automatically destroyed after the authorization expires
• Your agency never has access to plaintext card numbers
• All actions (authorization, charging, destruction) are logged for audit