Glossary

Quick reference for key terms used throughout the mCards developer documentation.

Term	Definition
API Key	Credential that identifies your partner account. Included in the `Authorization` header of every API request. Also referred to as `hmac_key`.
API Secret	Credential used to compute the HMAC-SHA256 signature for API requests. Never transmitted in requests. Also referred to as `hmac_secret`.
Authorization (Transaction)	The first message in a dual-message transaction. Determines whether the transaction is approved and places a hold on funds.
Available Balance	The portion of a currency or payment account balance that can be used immediately for transactions. Excludes held amounts.
Cardholder	The consumer who holds an mCards-issued card and initiates transactions.
Cardholder Card	A specific card issued to a cardholder under a distributor card (card program). Identified by `cardholder_card_uuid`.
Certification	The process partners complete before accessing production credentials. Includes functional validation, security review, and webhook verification.
Claimed Offer	An offer that a cardholder has redeemed during a transaction. Tracked via webhook events with lifecycle states (`hold`, `clear`, `hold_release`).
Clearing	The second message in a dual-message transaction. Finalizes the transaction and moves funds from hold to settled.
Currency	An alternative value system (loyalty points, rewards) managed via the Currency API. May be a payment or non-payment type.
Distributor	An organization that distributes mCards to cardholders. Manages locations, campaigns, and card programs.
Distributor Card	A card program template that defines how cards are issued. Also referred to as a "card program." Cardholders receive cards issued under these programs.
DPE (Dynamic Processing Engine)	The mCards component responsible for transaction authorization decisioning. Evaluates payment accounts in rank order to approve or decline transactions.
Dual-Message Transaction	A transaction processed in two steps: authorization (hold) followed by clearing (settlement).
Feature SSO Token	A signed JWT issued by mCards during feature onboarding flows. Contains cardholder identity claims. Expires after 5 minutes.
Held Balance	The portion of a balance temporarily unavailable due to pending authorization holds or unvested amounts.
HMAC-SHA256	The hash-based message authentication code algorithm used to sign all mCards API requests.
JWKS (JSON Web Key Set)	The endpoint where mCards publishes public keys for verifying JWT token signatures.
MCC (Merchant Category Code)	A four-digit code classifying the type of business where a transaction occurs (e.g., `5411` for grocery stores).
Non-Payment Currency	A currency type used for tracking and display only. Balances are not evaluated during transaction authorization.
Operations Account	A platform-level financial account associated with a payment gateway or currency provider, used for settlement and reconciliation.
Partner	An external organization integrated with the mCards platform via one or more APIs. Also referred to as a "development partner" or "developer partner."
Payment Account	The link between a cardholder card and a payment source (gateway or currency). Evaluated by the DPE during authorization.
Payment Currency	A currency type whose balance is evaluated by the DPE during transaction authorization. The currency provider does not participate in real-time decisioning.
Payment Gateway	A partner-operated payment platform that actively participates in real-time authorization decisioning via webhooks.
Payments User Token	A signed JWT issued by mCards during payment gateway onboarding flows. Contains cardholder identity and card context.
Rank Order	The configured priority sequence in which the DPE evaluates payment accounts during authorization. Lower rank = higher priority.
Sandbox (UAT)	The development and testing environment. Uses fictitious data and does not process real transactions.
Single-Message Transaction	A transaction where authorization and clearing occur simultaneously in one message.
Syndication	The association between a payment gateway (or currency) and one or more distributor cards (card programs), determining which cardholders can use that payment source.
System of Record	Determines who maintains the authoritative balance for a currency — either the partner (via API updates) or mCards (via incremental adjustments).
Webhook	An HTTP POST callback sent by mCards to a partner's registered URL when an event occurs (e.g., transaction, location, claimed offer).