> ## Documentation Index
> Fetch the complete documentation index at: https://www.marqeta.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Create PIN control token

> Creates a control token necessary when creating or updating a card's personal identification number (PIN).

<div className="mb-4 flex items-center gap-2"><span className="rounded-lg font-bold px-1.5 py-0.5 text-sm leading-5 bg-blue-400/20 text-blue-700 dark:text-blue-400">POST</span><span className="flex items-center gap-0.5 font-mono text-sm"><span className="text-gray-400">/</span><span className="font-medium text-gray-800 dark:text-white">{"pins"}</span><span className="text-gray-400">/</span><span className="font-medium text-gray-800 dark:text-white">{"controltoken"}</span></span></div>

Creates a control token necessary when creating or updating a card's personal identification number (PIN).

Creating, updating, or revealing a card's PIN is a two-step process. You must first create the control token that is required to create the PIN, and then you create, update, or reveal the PIN itself.

The lifespan of the control token in a production environment is either five minutes or one hour from creation, depending on the token type. If multiple tokens are requested for a single card, only the most recent one is valid. Once redeemed, a token cannot be reused.

<h2 id="_request_body">
  Request body
</h2>

| Fields | Description |
| - | - |
| card\_token<br />string<br />Required | The unique identifier of the card for which you want to generate a control token.<br />**Allowable Values:**<br />1–36 chars<br />Send a `GET` request to `/cards/user/{token}` to retrieve card tokens for a specific user. |
| controltoken\_type<br />string<br />Optional | Specifies the type of action completed by this request.<br />**WARNING:** Sending a request to this endpoint with a `REVEAL_PIN` control token requires PCI DSS compliance.<br />The lifespan of the control token depends on the token type:<br />- **SET\_PIN:** 60 minutes<br />- **REVEAL\_PIN:** 5 minutes<br />**Allowable Values:**<br />`SET_PIN`, `REVEAL_PIN` |

<h2 id="_sample_request_body">
  Sample request body
</h2>

```json JSON lines wrap theme={null}
{
  "card_token": "my_card_01",
  "controltoken_type": "SET_PIN"
}
```

<h2 id="_response_body">
  Response body
</h2>

| Fields | Description |
| - | - |
| control\_token<br />string<br />Returned | Unique value generated as a result of issuing a `POST` request to the `/pins/controltoken` endpoint. This value cannot be updated.<br />**Allowable Values:**<br />1-36 chars |

<h2 id="_sample_response_body">
  Sample response body
</h2>

```json JSON lines wrap theme={null}
{
  "control_token": "b4647c9a-d4b8-4091-a5ff-dd67a7bb9ffc"
}
```


## Related topics

- [PINs Overview](/docs/core-api/pins.md)
- [Create or update PIN](/docs/core-api/pins/create-update.md)
- [Reveal PIN](/docs/core-api/pins/reveal.md)
- [Create card](/docs/core-api/cards/create.md)
- [Create velocity control](/docs/core-api/velocity-controls/create.md)