See also the CreditCard response object.


Typically requires PCI SAQ D compliance

We recommend using $paymentMethod functions to avoid any PCI concerns with raw credit card data being present on your server.


If you have card verification enabled, any updates made to credit cards are subject to those rules.

$result = $gateway->creditCard()->update($creditCard->token, [
    'cardholderName' => 'New Holder',
    'cvv' => '456',
    'number' => '4111111111111111',
    'expiration_date' => '06/2022',
    'billingAddress' => [
        'region' => 'IL'
    'options' => [
        'verifyCard' => true
This code snippet now uses gateway instance methods instead of class-level methods. Learn more.
token required, string

An alphanumeric value that references a specific payment method stored in your Vault. Must be less than or equal to 36 characters. If using a custom integration, you can specify what you want the token to be. If not specified, the gateway will generate one that can be accessed on the result. If using our Drop-in UI with a customer ID to vault payment methods, you can't specify your own token. Length and format of gateway-generated tokens and IDs may change at any time.

Additional Parameters

A billing address associated with a specific customer ID. It can be further associated with a specific payment method. The maximum number of addresses per customer is 50.

'company' string

Company name. 255 character maximum.

'countryCodeAlpha2' string

The ISO 3166-1 alpha-2 country code specified in an address. The gateway only accepts specific alpha-2 values.

'countryCodeAlpha3' string

The ISO 3166-1 alpha-3 country code specified in an address. The gateway only accepts specific alpha-3 values.

'countryCodeNumeric' string

The ISO 3166-1 numeric country code specified in an address. The gateway only accepts specific numeric values.

'countryName' string

The country name specified in an address. We only accept specific country names.

'extendedAddress' string

The extended address information—such as apartment or suite number. 255 character maximum.

'firstName' string

The first name. 255 character maximum.

'lastName' string

The last name. 255 character maximum.

'locality' string

The locality/city. 255 character maximum.


Optional values that can be passed with a request.

'updateExisting' bool

Update the billing address associated with the payment method token specified. Other payment methods associated with the same billing address will have their addresses updated, as well.

'postalCode' string

The postal code. Postal code must be a string of 4-9 alphanumeric characters, optionally separated by a dash or a space. Spaces and hyphens are ignored.

'region' string

The state or province. 255 character maximum.

'streetAddress' string

The credit card billing street address. 255 character maximum. Required when performing card verification and AVS rules are configured to require street address.

'cardholderName' string

The cardholder name associated with the credit card. 175 character maximum.

'cvv' string

A 3 or 4 digit card verification value assigned to credit cards. The CVV will never be stored in the gateway, but it can be provided with one-time requests to verify the card.

'expirationDate' string

The expiration date, formatted MM/YY or MM/YYYY. May be used instead of expirationMonth and expirationYear.

'expirationMonth' string

The expiration month of a credit card, formatted MM. May be used with expirationYear, and instead of expirationDate.

'expirationYear' string

The two or four digit year associated with a credit card, formatted YYYY or YY. May be used with expirationMonth, and instead of expirationDate.

'number' string

The 12-19 digit value consisting of a bank identification number (BIN) and primary account number (PAN). Passing the number directly (rather than passing a nonce) should only be done in a PCI compliant environment. If in doubt, use paymentMethodNonce with PaymentMethod::update()


Optional values that can be passed with a request.

'makeDefault' bool

This option makes the specified payment method the default for the customer.

'verificationAmount' string

Specify a non-negative amount that you want to use to verify a card. If you do not pass this option, the gateway will automatically use a verification amount of $0 or $1, depending on the processor and/or card type.

'verificationMerchantAccountId' string

Specify the merchant account ID that you want to use to verify a card. See the merchantAccountId on Transaction::sale() to learn more. The merchant account can't be a marketplace sub-merchant account. See the Braintree Marketplace Guide to learn more.

'verifyCard' bool

This option prompts the gateway to verify the card's number and expiration date. It also verifies the AVS and CVV information if you've enabled AVS and CVV rules.


Braintree strongly recommends verifying all cards before they are stored in your Vault by enabling card verification for your entire account in the Control Panel.

In some cases, cardholders may see a temporary authorization on their account after their card has been verified. The authorization will fall off the cardholder's account within a few days and will never settle.

Only returns a CreditCardVerification result if verification runs and is unsuccessful.

Payment method nonces vs. raw card data

While it is possible to pass both raw card data and a payment method nonce in the same call, we recommend passing only a payment method nonce.

Passing both will result in a payment method that has a mix of their attributes, with precedence given to the fields individually, then to the attributes of the payment method nonce. For example, if you pass both a card number and a payment method nonce, the payment method will have the number you passed explicitly, but the rest of the attributes will be obtained through the nonce.