Network Tokenization (also referred to as Scheme Tokenization) replaces sensitive card data (PAN) with a token issued by the card networks (for example Visa, Mastercard, and others). The token represents the card in all payment flows, enabling Card-on-File (CoF) and recurring payments with significantly reduced fraud risk and, at the same time, improved authorization rates. Card networks—which assume the role of the token service—manage the token system, including the card lifecycle.

PAYONE, as your payment service provider, acts as the intermediary between you (the merchant) and the token systems of the card networks (for example Visa and Mastercard). As your payment service provider, PAYONE ensures end-to-end tokenization of the payment flow while orchestrating card lifecycle management with the token services. This enables smoother network tokenization enablement on your behalf, without impacting your existing integration or Card-on-File data.

PAYONE supports network tokenizations for VISA and Mastercard only.

What you gain with network tokenization

If you are using PAYONE for your web shop and our card tokenization combined with Card-on-File or Recurring features, you will automatically benefit and leverage the features of network tokenization:

Improved security
Network tokens replace sensitive card data, making the information useless to fraudsters if intercepted during a data breach. A unique, single-use cryptogram is also generated for each customer-initiated transaction, providing an additional layer of security.

Higher approval rates
The increased security and trust associated with network tokens lead to higher approval rates for transactions, especially for stored or recurring payments.

Lower costs
Tokenized transactions often qualify for lower interchange fees due to trustworthiness and elevated security of the network tokens, leading to lower processing costs.

How network tokenization works

1. Card data capture

Card details are captured in a PCI-compliant way (for example via hosted fields or a secure payment form).

2. Token generation

PAYONE requests a network token from the card networks’ tokenization service when a customer makes a purchase and decides to save it for future use. 
The network returns a unique token that represents the card

3. Token storage and usage

You (the merchant) store the pseudo card PAN provided by PAYONE under the customer profile together with non-sensiteve card details. All subsequent payments (authorization, capture, refunds, and recurring payments) use the network token instead of PAN.

4. Lifecycle management

GENERAL INFORMATION

PAYONE receives automatic token and card updates, such as card renewals or replacements and delivers the information to your backend via the Card Update Notifications. You will define the endpoint in PMI to instruct PAYONE for delivering card updates notifications near real time.

It is important to process the notifications in chronological order as defined by the timestamp.

Token update notifications

PAYONE delivers notifications for network token updates, such as when token is created (eventtype=TOKEN_CREATED) or token is updated (TOKEN_UPDATED).  An event of type TOKEN_CREATED is delivered when the card is tokenized for the first time and corresponding token system generates a network token linked to the card.

In case the token is SUSPENDED, DELETED or ACTIVE an event type of TOKEN_UPDATED is delivered. 

card update notifications

PAYONE delivers notifications for card metadata updates, such as when card is renewed, replaced or redigitized.  In such case updated card details like card expiration date, or last 4 digits are delivered as part of notifications. 

Parameter for the Card Updates Notifications

According to the configuration of your online shop, you will receive the data and the status for token or card update notifications via the URL you have stored with us. The data transfer is based on simple HTTP-POST request (key/value pairs) and are independent from transaction status notifications.

The notifications are sent from the following IP addresses: 185.60.20.0/24 (i.e. 185.60.20.1 to 185.60.20.254).
Please configure your firewall to allow incoming packets from these IP addresses.

Host: api.pay1.de
Content-Type: application/x-www-form-urlencoded charset=UTF-8
X-Auth-Code: payload signature   

Payload
timestamp=2025-10-11T20:11:57.745242035Z
mode=LIVE
eventtype=TOKEN_CREATED
pseudocardpan=9550010000004019645
cardtype=M
cardexpiredate=2512
cardpansuffix=5025
tokennumber=5185741489158738
paymentaccountreference=5001BFQRBT8D2I33UPHYZ4JUTSWAV
tokenexpiredate=2811 
tokenstatus=ACTIVE 



                 

RESPONSE
TSOK