Starting November 18, 2021, there will be critical improvements to the My Cards API endpoint:
_10POST_10https://{accountName}.{environment}.com.br/api/checkout/pub/current-user/payment-tokens
This request is used when a customer registers a new credit card through the My Cards page.
The most significant change is the requirement of reCAPTCHA validation, which dramatically reduces the likelihood of card attacks to this particular API path.
What needs to be done
If your store uses our native UI in the My Cards page, the change should happen automatically. In this case, we expect no action will be needed, but recommend you revise the page’s layout, to ensure it works properly.
Note that, in order to test this validation on your store, you must access it through the public address (without the myvtex environment), using a common user, without store administrator or developer privileges.
If your store uses any UI implementation that communicates directly with this API endpoint, such as proprietary sites or apps, get in touch with our support so as to update your implementation accordingly.