For AI agents: the complete documentation index is at /llms.txt, and the full text of every page is at /llms-full.txt. Most pages are also available as Markdown by adding .md to the URL.
These solutions are available in US and Canada only. For all other regions, please contact us for support.
Tokenization is the capability to securely store and manage payment methods on our API and across both online (card not present) and in-store (card present) environments. It involves replacing sensitive data (e.g. card PAN, ACH/EFT bank routing & account numbers) with unique strings, or tokens, that retain all the essential information about the data without compromising its security. These tokens can be used in place of the actual data to perform operations, such as processing payments, without exposing the sensitive information itself.
The PCI DSS sets stringent requirements for handling and storing card information. Tokenization helps businesses comply with these regulations by minimizing the amount of sensitive data they handle and store.
What we tokenize
Cards - PAN, expiry, and related metadata
Bank accounts (ACH/EFT) - routing/transit and account numbers
Payment token types
Payment tokens are different from the Auth tokens required to authorize and use our API. For more information on Auth tokens, see our guide.
There are two types of payment tokens:
Single-Use Payment Token – A Temporary token is valid for only a certain amount of time and for a single use, thus eliminating the risk of reuse in fraudulent activities. This single use token is automatically deleted after a few minutes, unless it is explicitly converted to a multi-use token to store the card information.
Multi-Use Payment Token – Can be used for multiple transactions. These tokens are typically linked to a specific payment method and can be reused for various transactions until they are explicitly invalidated. They provide a balance between security and convenience, making them suitable for scenarios where recurring transactions are needed.
Account Updater
What is it?
The Card/Account updater service allows merchants to keep their stored cards up-to-date. This process is achieved by reaching out to the card schemes with the stored card information, and in response will be updated or a message returned about the respective cards. Card Account Updater electronically provides updated card info (new PAN/expiry) from participating Visa and Mastercard issuers to acquirers/merchants for account-on-file use cases (subscriptions, auto-bill, recurring, memberships, T&E). Issuer participation varies; not all issuers support CAU.
How it works
We submit your vaulted card tokens to Visa Account Updater / Mastercard Automatic Billing Updater.
Networks return changes (e.g., new card number/expiry, reissue updates).
Your stored payment token is refreshed with the latest card data—no customer action needed.
Supports multiple updates to the same account; delivered over secure channels.
Benefits
Fewer declines: Replace stale card details to reduce recurring/COF failures.
Better continuity: Charge after service delivery with less “card changed” fallout.
Smoother refunds: Tokenized refunds still work even if the card credentials changed.
Operational savings: Automated, timely updates vs. chasing customers manually.
Coverage & limits
Networks: Visa, Mastercard, American Express and Discover.
Scope: Updates when cards are reissued/expired; does not cover closed accounts, bank switches, or non-participating issuers.
Use cases: Recurring, installments, subscriptions, and other card-on-file transactions.
Next steps
Now that you have an understanding of the tokenization types, the next step is to look at the tokenization capabilities our API can provide you.
