Skip to main content

Collect Inbound Sensitive Data

This guide will show you how to collect data sent to your API without touching the data.

Key concepts in this guide:

Getting Started​

To get started, you will need a Basis Theory account.

Next you will need a Management Application in order to provision the components in this guide.

Click here to create a Management Application or login to your Basis Theory account and create a new application from the Full Management Access template.

Save the API Key from the created Management Application as it will be used in this guide to provision everything.

Create the Proxy​

We will create a Proxy capable of intercepting inbound calls to our API, tokenize part of the request, and send the modified request to our API.

The Basis Theory Proxy uses a request transform running on a Node.js runtime image. The following code tokenizes the request:

const { BasisTheoryClient } = require("@basis-theory/node-sdk");

module.exports = async function (event) {
  const { req, applicationOptions } = event;
  const socialSecurityNumber = req.body.socialSecurityNumber;

  const client = new BasisTheoryClient({
    apiKey: applicationOptions.apiKey,
    baseUrl: applicationOptions.baseUrl
  });

  const token = await client.tokens.create({
    type: "token",
    data: socialSecurityNumber
  });

  return {
    req: {
      headers: req.headers,
      body: {
        ...req.body,
        socialSecurityNumber: token.id
      }
    }
  };
};

This code reads the socialSecurityNumber property from the request body, tokenizes it with the Basis Theory Node.js SDK, and replaces the original value with the token ID. The Proxy runtime receives a scoped API key because the runtime configuration grants token:create.

We need to create an instance of a Proxy with the previous code as a request_transform.

First, let's store the JavaScript code as a variable. In your terminal, run the following:

javascript='const { BasisTheoryClient } = require("@basis-theory/node-sdk");

module.exports = async function (event) {
  const { req, applicationOptions } = event;
  const socialSecurityNumber = req.body.socialSecurityNumber;

  const client = new BasisTheoryClient({
    apiKey: applicationOptions.apiKey,
    baseUrl: applicationOptions.baseUrl
  });

  const token = await client.tokens.create({
    type: "token",
    data: socialSecurityNumber
  });

  return {
    req: {
      headers: req.headers,
      body: {
        ...req.body,
        socialSecurityNumber: token.id
      }
    }
  };
};'

Next, we need to create an instance of a Proxy, with the variable we created:

curl "https://api.basistheory.com/proxies" \
  -H "BT-API-KEY: <API_KEY>" \
  -H "Content-Type: application/json" \
  -X "POST" \
  -d '{
    "name": "Inbound Proxy Example",
    "destination_url": "https://echo.basistheory.com/anything",
    "request_transforms": [
      {
        "type": "code",
        "code": '"$(echo $javascript | jq -Rsa .)"',
        "options": {
          "runtime": {
            "image": "node24",
            "dependencies": {
              "@basis-theory/node-sdk": "6.1.1"
            },
            "permissions": ["token:create"]
          }
        }
      }
    ],
    "require_auth": false
  }'
Replace <API_KEY> with the Management API Key from Getting Started.
Save the proxy key from the response as it will be used to invoke the proxy.

This is using jq to replace the JavaScript code as a JSON escaped string value. It will create a new Proxy instance where we will run the request_transform on the inbound Proxy request against the body and headers of the request. The proxy will then send the request to our destination_url, which should be your API URL. In this guide, we are going to use https://echo.basistheory.com/anything so we can see the tokenized socialSecurityNumber.

Invoke the Proxy​

Now that we have our Proxy created, we need to invoke it. In your terminal run the following:

curl "https://api.basistheory.com/proxy" \
  -H "BT-PROXY-KEY: TDEyQmkhQMpGiZd13FSRQ9" \
  -H "Content-Type: application/json" \
  -X "POST" \
  -d '{
    "socialSecurityNumber": "123-45-6789"
  }'
Be sure to replace TDEyQmkhQMpGiZd13FSRQ9 with the key of the Proxy you created in the Create the Proxy step.

If successful, you should see an output similar to this:

{
  "args": {},
  "data": "{\"socialSecurityNumber\":\"8b4f3aab-abc6-423f-86b9-c368919bdc65\"}",
  "files": {},
  "form": {},
  "headers": {
    "Accept": "*/*",
    "Accept-Encoding": "gzip",
    "Bt-Trace-Id": "0us+cYwAAAACCDkUl9kKnRY3yEEMzpsZ/Q0hHRURHRTE2MTkAMTYzY2E1ODMtNjQ3MS00MTc3LTg0ZGItZTA4MzBlZGFiODUw",
    "Content-Length": "63",
    "Content-Type": "application/json",
    "Disguised-Host": "echo.basistheory.com",
    "Host": "echo.basistheory.com",
    "User-Agent": "curl/7.85.0",
    "X-Forwarded-Tlsversion": "1.2",
    "X-Original-Url": "/anything",
    "X-Waws-Unencoded-Url": "/anything"
  },
  "json": {
    "socialSecurityNumber": "8b4f3aab-abc6-423f-86b9-c368919bdc65"
  },
  "method": "POST",
  "url": "https://echo.basistheory.com/anything"
}

Notice that the socialSecurityNumber was successfully replaced with our tokenized value.

Now that you have your token, check out our guide on how to send data to a third-party!

Learn More​

Last updated on