It’s generally not considered safe to expose the raw tokens to your users to use in your api. In fact if your using the system to try to avoid the headaches of PCI DSS, if you expose tokens as means of payment they’ll consider the token to be a card equivalent.

Instead the best practice would be to tokenize the data, accept it through one channel (an AttachCard api or whatever) and then return to your api consumer another opaque token to use for actions like authorization or clearing. From here there you can ensure that tokens are never reused etc.

This way if tokens leak they should be “inert” and no actions should be able to be taken with them.