Visa Token Service Provisioning and Credential Management
Issuer enables the Visa card to be securely and conveniently used in digital wallets in order to keep the card top-of-wallet and remove the need to re-issue a card when a device with a digital wallet is lost.
Thank you for your interest in Visa Token Service Provisioning and Credential Management. As a first step to learning more about this product, please contact either your Visa Account Executive, Gateway or Acquiring partner and/or visit our detailed product page at Visa Ready. You can also submit any specific queries about the product through Visa Ready using the ‘Contact Us’ link. Thank you again for your interest.
available for use by
Issuer Banks
Regional Availability
View Details- N. America
- Asia-Pacific
- Europe
- CEMEA
- LAC
pricing
Flexible and scalable ways to securely issue tokens
The Visa Token Service Provisioning and Credential Management APIs can provide issuers with flexible and scalable ways to help securely issue tokens and enable their use in e-commerce, m-commerce, in-app, and contactless purchases.
These API’s allows issuers to replace sensitive account information, such as a 16-digit Primary Account Number (PAN), with a unique digital identifier called a token. Tokenization protects card data by substituting a card's PAN with a unique, randomly-generated sequence of numbers. The generated number is the same length and format as the original PAN. Therefore, it is no different from a standard payment card number in the virtual eyes of back-end transaction processing systems, applications, and databases.
Key Features
Secure
Using tokens can help protect sensitive information from theft and fraud.
Multi Channel Support
Supports online, in-store, and mobile in-app purchases with flexible deployment and management options.
Improves Cardholder Experience
Can help simplify consumer purchasing experience using digital wallets.
Why Use It?
Security
Tokenization is based on the EMVCo payment tokenization standard and aligns with EMV1 technology (the global standard for secure payments). By participating in tokenization, issuers will minimize the risk of fraudulent use of data if the device or account is compromised. Using a token instead of a PAN at the point of sale helps allow payments to be processed without exposing actual account details that could potentially be compromised.
1 EMV is a registered trademark or trademark of EMVCo LLC in the United States and other countries, www.emvco.com.
Flexibility
Allows issuers and processors flexibility over how to deploy and manage secure digital accounts. They can set token variables (including transaction thresholds and time limits) and identify authorized token requestors.
How Does It Work?
Token Provisioning
A consumer enrolls their Visa account with a digital payment service provider (such as an online retailer or mobile wallet) by providing their primary account number (PAN), security code, and other account information. The digital payment service provider requests a payment token from Visa for the enrolled account. Depending on the use case, Visa may share the token request with the issuing bank. With the account issuer’s approval, Visa replaces the consumer’s PAN with the token. Visa then shares the token with the digital payment service provider for online and mobile (NFC) payment use. A payment token can be limited to a specific mobile device, e-Commerce merchant, or number of purchase transactions before expiring.
Tokenization requires a new stakeholder role known as token requestor. Token requestors are entities who initiate the process of tokenization. In order to request tokens from the Visa Token Service, you must first register with Visa as a token requestor and agree to comply with Visa's participation requirements and processes.
The API’s allow issuers to participate in the tokenization process in order to securely provision a token on a device in partnership with Visa and wallet providers. The process involves the following interactions between token requestor, Visa and issuer.
- Provisioning
- Credential Management
- Notifications
APIs Included
Check Eligibility
During the token provisioning flow on a device, Visa will invoke this API call to the issuer with ID&V and other relevant attributes. This service allows issuers to: Pre-screen the cardholder who is about to start provisioning of tokens to a digital wallet. Provide reference to Card Art and Terms & Conditions (T&Cs) for a specific cardholder PAN. Deliver Token Reference ID that can be used by the issuers in subsequent calls to Visa, for example, in Token Lifecycle control APIs, instead of using the token value. The three functions of the API described above are optional; the issuer may opt to participate in this API integration for a subset of the described functions. Because participation in this API is optional, the issuer may decide to provide all required information to Visa so that Visa can perform On-Behalf processing.
Approve Provisioning
During the token provisioning flow on a device, Visa will invoke this API call to the issuer with ID&V attributes and other relevant attributes so that the issuer can take appropriate action, such as approve, decline, or step-up, based on those attributes to provision the token.
Get Cardholder Verification Methods
During the token provisioning flow, Visa will invoke this API that allows the issuer to provide supported methods of cardholder step-up authentication, for example, tenured data (cardholder email, phone number) for delivering One-Time-Password (OTP).
Send Passcode
During the token provisioning flow, Visa will invoke this API to deliver the OTP to the destination selected by the cardholder, such as an email address, via the issuer.
Token Inquiry
Enables the issuer to retrieve token details for a particular token, including device and risk information.
Token Inquiry By PAN
Enables the issuer to retrieve a list of tokens for a PAN.
Token Lifecycle
Enables the issuer to activate, resume, suspend or delete the token.
PAN Lifecycle
Enables the issuer to update PAN and PAN expiration date. It also enables to perform VAU updates.
Update Card Metadata
Enables the issuer to update Card Metadata attributes associated with the card after the card was provisioned in the digital wallet. For example, if the product changes after the initial successful provisioning (for example, cardholder account is upgraded to Visa Signature), the issuer can take advantage of this API to change Cart Art images without requiring re-provisioning.
Approve Provisioning Stand-In Notification
If the Approve Provisioning API fails during the token provisioning flow on a device, then Visa will invoke this notification to the issuer with the provisioning data and the appropriate stand-in (STIP) attributes.
Token Create Notification
When a token is successfully created on a device during the token provisioning flow, then Visa will invoke this notification to the issuer with the appropriate token data.
Token Notification
Visa will invoke this notification to the issuer whenever a token status is changed by the issuer.
Card Metadata Update Notification
Visa will invoke this notification upon receiving a notification from the wallet provider of the status of the card metadata update on the device.
Review VCEH Profiles
Enables the issuer to get a list of token requestors participating in the Visa Card Enrollment Hub solution, which includes the corresponding logo, brand information to be displayed in the Issuer Card Connections UI, and the corresponding token requestor application invocation URLs.