Cards

MuPag does not receive PAN or CVV. In the direct B2B flow, the merchant obtains a token from Asaas and sends it to the authenticated backend. In hosted checkout, the buyer enters card details on the official Asaas invoice opened through the session's hosted_payment_url.

Direct B2B boundary rule

• sk_* is required to create a direct B2B charge.
• Send a merchant-attested literal payer_ip and the complete customer identity (name, email and tax_id), even when providing customer.id.
• The flow supports a single installment, rejects soft_descriptor and fails before side effects when policy requires 3DS.
• Never log a full card number in support, analytics or runtime traces.

When this matters

• Charges with payment_method: "credit_card"
• POST /v1/subscriptions/{id}/update-card when rotating the saved token

Hosted checkout

Checkout sessions support PIX and single-payment cards when the merchant has an available real integration. The frontend opens the official hosted_payment_url; it does not collect card details, CVV or PSP tokens. Simulation-only accounts do not offer this invoice: use PIX in those scenarios. Read the session status or wait for the webhook to confirm payment.