# Enroll a Card with the Enroll Synchronous API
source: https://developer.mastercard.com/issuer-enrollment/documentation/use-cases/push-provisioning/enroll-api/index.md

This guide is for issuers using the synchronous Enroll Synchronous API for customer-initiated push provisioning into Click to Pay only. The Enroll Synchronous API is the supported option for this flow and enrolls a cardholder's selected card from your app or website by submitting encrypted card data or a push account receipt from MDES Token Connect.
Note: Push provisioning currently supports enrollment into Click to Pay only.

### Prerequisites {#prerequisites}

* Complete the [Quick Start Guide](https://developer.mastercard.com/issuer-enrollment/documentation/quick-start-guide/index.md#before-you-begin) prerequisites.
* Enroll in Mastercard Digital Enablement Service (MDES) to activate cards and receive token requests.
* Perform strong cardholder authentication before push provisioning. Mastercard recommends not requesting additional cardholder authentication during push provisioning.
* Present Click to Pay in the your app or website, and obtain the cardholder's consent for the selected card.
* Provide the Click to Pay [Terms and Conditions](https://www.mastercard.com/global/click-to-pay/country-listing/terms.html) and [Privacy Policy](https://www.mastercard.com/global/click-to-pay/country-listing/privacy.html) URLs in the `POST /cards` request `complianceSettings` object.
* For PUSH_ACCOUNT_RECEIPT-based enrollment, send a request to the MDES Token Connect [Get Eligible Token Requestors](https://developer.mastercard.com/mdes-token-connect/documentation/api-reference/#tag/Get-Eligible-Token-Requestors) and [Get Assets](https://developer.mastercard.com/mdes-token-connect/documentation/api-reference/#tag/Get-Assets) APIs to present Click to Pay in your app or website.

## Enroll a Card in Click to Pay Workflow {#enroll-a-card-in-click-to-pay-workflow}

Use the Enroll Synchronous API when a cardholder initiates enrollment in your app or website, you want to design and control the cardholder experience, and will submit the enrollment request directly. There are two methods for sending Mastercard the card details for enrollment:

* Using its primary account number (PAN). With PAN-based enrollment, you encrypt the card details and send them in the `encryptedCard` object.
* Using the `pushAccountReceipt` from MDES Token Connect.

Diagram consumer-is-enrolled

1. Cardholder logs into your app or website and is given the option to enroll their eligible card(s) in Click to Pay.

2. Cardholder selects the card they want to enroll, reviews prepopulated details, and provides consent.

3. Send a `POST /cards` request to enroll the card using the selected enrollment method.   

   See the endpoint structure:


   API Reference: `POST /cards`

   1. Encrypt the selected card using JSON Web Encryption (JWE), following the `Card` schema described in the [encryption tutorial](https://developer.mastercard.com/issuer-enrollment/documentation/tutorials-and-guides/perform-encryption-tutorial/index.md#step-2-encrypt-an-object).
   2. Include the `encryptedCard` object in the `POST /cards` request.
   1. Send a request to the MDES Token Connect [Push Multiple Accounts](https://developer.mastercard.com/mdes-token-connect/documentation/api-reference/#tag/Push-Multiple-Accounts) API with selected card and billing information to obtain a `pushAccountReceipt`.
   2. Include the `pushAccountReceipt` as the `enrolmentReferenceId` in the `enrolmentReferenceData` object of the `POST /cards` request, with `enrolmentReferenceType` set to PUSH_ACCOUNT_RECEIPT.
4. Click to Pay sends a request to MDES to tokenize the card.

5. MDES requests issuer approval to tokenize the card for Click to Pay.

6. After receiving approval, MDES tokenizes the card and returns the tokenized card details to Click to Pay.

7. Click to Pay enrolls the card, creates the profile, and returns a `200` success response that includes the enrolled card details.

## Compliance Settings URLs {#compliance-settings-urls}

When submitting the `POST /cards` enrollment request, you must include Mastercard's Click to Pay [Terms of Use](https://www.mastercard.com/global/click-to-pay/country-listing/terms.html) and [Privacy Notice](https://www.mastercard.com/global/click-to-pay/country-listing/privacy.html) URLs in the `complianceSettings` object.

You can add the `locale` parameter to the end of either URL so cardholders can view the Click to Pay Terms of Use and Privacy Notice in that language.

Use the following URI format, where `xx` is the ISO 639 language code and `YY` is the ISO 3166 country code. For example, `en_US`.

```json
"complianceSettings": {
  "privacy": {
    "latestVersionUri": "https://www.mastercard.com/global/click-to-pay/country-listing/privacy.html?locale=xx_YY"
  },
  "tnc": {
    "latestVersionUri": "https://www.mastercard.com/global/click-to-pay/country-listing/terms.html?locale=xx_YY"
  }
}
```

## Enrollment User Experience {#enrollment-user-experience}

To initiate push provisioning, present Click to Pay on your banking app or website through a selected interface.

The following examples illustrate how Click to Pay might appear in a banking app or website using a button or in-app banner:

### Click to Pay button {#click-to-pay-button}

Tip: Position the **Click to Pay** button at parity with other digital wallet enrollment options.

![Click to Pay button](https://static.developer.mastercard.com/content/issuer-enrollment/documentation/img/click-to-pay-button-r5.png "Click to Pay button")

### Click to Pay in-app banner {#click-to-pay-in-app-banner}

Tip: Issuer implementations have shown that prominently placed in-app Click to Pay banners can significantly increase enrollment volume and improve conversion rates.

![Click to Pay banner](https://static.developer.mastercard.com/content/issuer-enrollment/documentation/img/banner-r5.png "Click to Pay banner")
Note: UX images are for illustrative purposes only. Contact a Mastercard representative for more information.

## Error Resolution {#error-resolution}

Test the Enroll API in Sandbox before requesting Production access. Use the [Testing guidance](https://developer.mastercard.com/issuer-enrollment/documentation/testing/index.md) and the [Enroll API operation reference](https://developer.mastercard.com/issuer-enrollment/documentation/api-reference/index.md#enroll-api-synchronous) to validate the request and response. For API errors, see [Codes and Formats](https://developer.mastercard.com/issuer-enrollment/documentation/code-and-formats/index.md).

## Next Steps {#next-steps}

* Retrieve, update, or delete a consumer's profile or associated credentials. For more information, see [Manage Consumer Profiles and Credentials](https://developer.mastercard.com/issuer-enrollment/documentation/use-cases/auto-enrollment/life_cycle/index.md).