---
updatedAt: 2025-11-11T01:48:54.000Z
agentTools:
  projectIndex: https://docs.pci-proxy.com/llms.txt
---

# How Reveal works

Reveal sensitive card data in native mobile applications.

The following diagram shows how the Show API works for native mobile applications.

<Image alt="Show API for native mobile applications" align="center" src="https://files.readme.io/499440f-image.png">
  Show API for native mobile applications
</Image>

1. The backend of your application receives a request to display card data.
2. [Check](https://docs.pci-proxy.com/docs/show-api-security-and-compliance) if the user is allows to see plain text card data.
3. Assemble the request with the card and/or CVV tokens mapped to the user and submit the request to PCI Proxy.
4. PCI Proxy returns a `transactionId` to your backend, which is **valid for 30 minutes** and can be **consumed once**.
5. Pass on the `transactionId` to the mobile application.
6. Call the Reveal endpoint with the `transactionId` in the body from the mobile application.
7. The Reveal API returns plain text card numbers and CVVs to the mobile application.

> 📘 `transactionId`s obtained via the Show API allows access to sensitive data.
>
> Do not store them anywhere unless absolutely necessary and consume them as soon as possible.