Simulate an authorization to check if the card is currently valid.
| Environment | Method | Endpoint |
|---|---|---|
| Sandbox | post | https://apisandbox.cieloecommerce.cielo.com.br/1/zeroauth/ |
| Production | post | https://api.cieloecommerce.cielo.com.br/1/zeroauth/ |
The example on this page is valid for sending the card with open data (not tokenized).
Important
- To enable Zero Auth, contact the Cielo support team. If the API returns error code 322, contact Support to enable the functionality;
- If the API returns error 389 – Registration Restriction, contact the commercial manager to check if the service is correctly enabled; if it is, the response indicates that this attempt cannot be validated due to Cielo's internal criteria. We recommend trying another card to complete the validation;
- To simulate authorization scenarios, check the Zero Auth documentation in sandbox.
Card brands available in Zero Auth
Zero Auth is available for Visa, Mastercard, Elo, and Diners*.
*Available starting October 2026.
If the response is negative, do not submit the card for authorization.Submit the card for authorization only if the Zero Auth verification response code is positive.
Tokenized Visa Card Verification TransactionsStarting on 04/17/2026, it will be required to send the cryptogram in card verification transactions using tokenization with the Visa card brand:
- Send the DPAN (token) in the
Card.CardNumberfield;- Send the cryptogram in the
Card.SecurityCodefield.
TLID Mastercard
The Transaction Link Identifier (TLID), sent and returned in the TransactionLinkId field, is a unique identifier generated by the Mastercard card brand during a CIT transaction, used to link the related MIT transactions. The TLID applies to the Zero Auth response (response only) and to credit card, debit card, and merchant recurrence transactions.
For Mastercard, send IssuerTransactionId and TransactionLinkId together in MIT transactions: both parameters are mandatory.
| Phase | Description |
|---|---|
| Phase 1 | Current. TransactionLinkId available in the responses of card validation by Zero Auth, credit card payment creation, debit card payment creation, and in the query by PaymentId. |
| Phase 2 | Mandatory sending of the TransactionLinkId in the request (MIT) starting October 23, 2026. |
Scheduled recurrence: in subsequent transactions, the
IssuerTransactionIdandTransactionLinkIdfields are sent automatically.
The TransactionLinkId sent in the request must have exactly 22 characters (A-Z, a-z, 0-9, hyphens, and underscores). If the value doesn't match this format, Cielo ignores it and returns no error. When Cielo sends the TLID to the card brand, the response also includes the SentTransactionLinkId with the value sent. The Zero Auth request doesn't accept this field.
See more details in Card Brand Identifiers.
Zero Auth Validation Response
The response always indicates whether the card can be authorized at that moment. This information only means that the card is valid for transactions, but it does not guarantee that a specific amount will be authorized.
The fields returned in the response depend on the validation result. The following table lists all possible fields.
| Parameter | Description | Type | Size |
|---|---|---|---|
Valid | Card status:
| Boolean | |
ReturnCode | Return code. Refer to the Zero Auth Return Codes. | String | 2 |
ReturnMessage | Return message. Refer to the Zero Auth Return Codes. | String | 255 |
IssuerTransactionId | Transaction identifier generated by the card brand, returned in the Zero Auth response. Zero Auth does not receive this field in the request. Store the value to send it, as mandatory, in subsequent recurring credit and debit transactions. In scheduled recurrence, the field is sent automatically in subsequent transactions. See more details in Card Brand Identifiers. | String | 30 |
Payment.TransactionLinkId | Unique identifier (TLID) generated by Mastercard and returned in the Zero Auth response. Zero Auth does not receive this field in the request. Store the original value to send it, together with the Format: 22 alphanumeric characters (A–Z, a–z), case-sensitive, and may include hyphens (-) and underscores (_). | string | 22 |