Guides
Network tokenization: what it is and why it can lift approval rates
Network tokenization replaces a card number with a token issued by the card network (Visa, Mastercard and others). The token is tied to one merchant or token requestor, includes a per-transaction cryptogram, and is updated by the network when the card is reissued. For stored-card and recurring payments, that can mean fewer declines and less exposure if data leaks.
What is network tokenization?
When a customer saves a card, the merchant's token requestor asks the network for a token. The network maps that token to the real card number (PAN) in its own vault. On each payment the merchant sends the token plus a cryptogram; the network swaps it back to the PAN for the issuer. The specification is published by EMVCo (EMVCo).
Network tokens vs gateway tokens vs vault tokens
The portability column matters when you work with more than one provider: a token locked to one provider makes switching or routing harder.
| Token type | Issued by | Usable with other providers | Updated on card reissue |
|---|---|---|---|
| Network token | Card network | Depends on token requestor setup | Yes, by the network |
| Gateway/processor token | One payment provider | Usually no | Only via account updater |
| Vault token | Your own or third-party vault | Yes, if the vault forwards PANs | Only via account updater |
How a network token payment works
The end-to-end path from saved card to authorisation looks like this:
- Save card The customer saves a card at checkout.
- Provision token The token requestor provisions a network token for that card.
- Generate cryptogram At payment time, a cryptogram is generated for the token.
- Acquirer sends token The acquirer sends token and cryptogram through the network.
- Issuer decision The network de-tokenises and forwards the PAN to the issuer, which approves or declines.
Benefits of network tokens
Networks and issuers design these credentials for repeat and card-on-file use.
- Lifecycle updates: when a card expires or is replaced, the token keeps working. This is the main benefit for recurring payments.
- Approval rates: issuers see a cryptogram-backed, merchant-bound credential. Networks publish their own figures for any uplift (Visa Token Service). Results vary by issuer and region.
- Lower breach impact: a stolen token is typically unusable outside its domain.
- Fewer interruptions: fewer "update your card" prompts, which also helps checkout conversion.
Limits to plan for
Network tokens are powerful but not universal.
- Not every issuer supports provisioning in every market.
- Setup goes through a token requestor (often your provider), with onboarding steps.
- Network tokens cover cards only. Alternative payment methods have their own credential models.
- Reporting must handle token and PAN references side by side during migration.
Token portability when you use several providers
If each provider holds its own tokens, moving volume between providers means asking customers to re-enter cards. Plan where tokens live before you add a second acquirer: either a provider-agnostic vault, or a setup where network tokens can be used through more than one acquirer.
How OrsunPay helps
OrsunPay is a payment orchestration platform that connects you to licensed PSPs; it does not process or hold funds itself. It connects your providers behind one API so routing decisions are not locked to a single provider's stack. Combine that with network tokens from your connected providers to keep stored cards working across smart routing rules. Security details are on our security page; plans are on pricing.
Frequently asked questions
What is network tokenization in simple terms?
Replacing a card number with a network-issued token that only works for a specific merchant and is updated when the card changes.
Is network tokenization the same as encryption?
No. Encryption scrambles data that can be decrypted with a key. A token is a substitute value mapped to the card in the network's vault.
Do network tokens remove PCI DSS scope?
They reduce the card data you handle, but PCI scope depends on your whole integration (see the PCI Security Standards Council).
Do network tokens work for one-off payments?
Yes, but the biggest gains are for stored cards and repeat charges.