Network tokens
Last updated: March 26, 2025
Network tokens are unique digital identifiers used to provide symbolic placeholder data across the payment flow, instead of the primary account number (PAN). Using network tokens:
- Reduces declines due to expired or replaced cards because the card schemes automatically update the underlying card details
- Reduces customer friction because the underlying card details are updated by the card schemes without any action by the customer
- Provides an additional security layer and reduces the risk of fraud because sensitive card details are only ever exposed to the card scheme and issuer
Visa and Mastercard provision network tokens via the Visa Token Service (VTS) and Mastercard Digital Enablement Service (MDES), respectively.
Information
For more information, see the network tokens blog post.
When you request network tokenization, the transaction goes through the following process:
- Initialization – The customer enters their full card details during checkout on your website.
- Provisioning request – You share the full card details with Checkout.com via the payment request. Checkout.com uses the card details to request a network token from the card scheme.
- Network token processing – The card scheme automatically generates a network token and shares this with the issuer and Checkout.com.
- Storage – Checkout.com stores the network token in your Vault for future use.
In future payment requests you can use the network token instead of the full card details. If you do so, the transaction goes through the following process:
- Authorization – You request a payment using a card or payment instrument. If Checkout.com detects that a network token is available, we send this to the card network instead of the card details. The card network generates a cryptogram for the authorization which is unique to the combination of the network token, the merchant, and the specific transaction.
- Decryption – The card scheme decrypts the network token to retrieve the card details. The details are shared with the issuer for verification.
- Payment processing – The issuer verifies the card details. The transaction is processed and the payment is approved.
If the customer's card expires or is replaced, the card scheme automatically updates the network token's underlying card details.
By default, network tokens are provisioned asynchronously.
The initial payment in which you request provisioning is processed with full PAN (FPAN), while the card details are tokenized in the background.
If provisioning is successful, you can use the network token in subsequent payment requests.
The initial payment in which you request provisioning is not processed until a network token is available.
If provisioning is successful, you can use the network token to process the initial payment.
Information
To enable synchronous provisioning, contact your Account Manager or [email protected].
By default, Checkout.com automatically:
- Requests network token provisioning on your behalf if you request a Visa or Mastercard payment with a new card
- Provides a network token if you request a payment with a card that was already provisioned
If you do not want to request network token provisioning, set the processing.provision_network_token field to false in your payment request.
post
https://api.checkout.com/payments
If provisioning is successful, Checkout.com automatically:
- Uses the network token in future payment requests
- Keeps the network tokens up to date by handling token lifecycle events from card schemes and issuers
You can monitor the results of your network token provisioning requests in the Dashboard.
- Sign in to the Dashboard.
- Go to Vault > Network tokens.
From this page, you can view:
- The card scheme response to a provisioning request, via a network token provisioning code
- The percentage of successful and unsuccessful provisioning requests
- The total number of provisioning requests
- A breakdown of the success and failure rates for each card scheme
- A breakdown of the most common failure reasons for each card scheme
If a payment you requested using a network token is declined with any of the following API response codes, Checkout.com automatically retries the payment using the full PAN (FPAN):
20003 - Invalid merchant or service provider20030 - Format error20068 - Response received too late / Timeout20091 - Issuer unavailable or switch is inoperative20096 - System malfunction
Information
Using FPAN may incur a higher scheme fee in some regions. To opt out of full PAN fallback, contact your Account Manager or [email protected].