2026-02-16 mitch

I work at a company that uses (among other gateways) Braintree (owned by PayPal) for a payment gateway. Our website's payment method form employs the workflow described here for the server-side and here for the client-side. In short, the customer's browser calls our web API to get a client_token, which we get from Braintree via our server-to-server API. With that client_token, the browser is meant to submit credit card details (number, exp date, CVV) directly to Braintree via their client API and get back a "nonce". Then the browser sends the nonce back to our servers, and we "redeem" it with Braintree to verify the card and, pending success, add it to our "vault" for that customer. This workflow is valuable because we never traffic in the card numbers, and so are subject to less of the PCI DSS. The major problem that we just discovered with this workflow is that the client_token permits the Braintree client API to validate (sic) credit cards. The client token is reusable and good for 24 hours, and is sufficient permission to submit any number of credit card numbers directly to the Braintree client API, which returns a clear signal of success or failure.