Network Token
What Is a Network Token? Definition and How It Works
Definition
A network token is a payment credential issued directly by a card network such as Visa or Mastercard to replace a card's primary account number, providing a more secure and updatable token that improves authorisation rates on stored-credential and digital transactions.
How it works
Network tokens are issued through card network token services, Visa Token Service (VTS) and Mastercard Digital Enablement Service (MDES). When a card is enrolled in a token service, the network generates a token specific to the requestor (a merchant, wallet, or payment provider) and the domain (e-commerce, in-app, device-based). The token maps back to the underlying PAN at the network level.
Unlike gateway tokens, which are generated by a payment provider and stored in the provider's vault, network tokens are scheme credentials. The card network maintains the mapping between token and PAN. When the underlying card is reissued, replaced due to expiry, or updated following a fraud event, the network updates the token mapping automatically, without requiring the merchant to recollect card details from the cardholder.
When a merchant presents a network token for authorisation, the card network dereferences it back to the PAN before routing the request to the issuer. Issuers receive what appears to be a standard authorisation request, but the token metadata signals to the issuer that this is a verified, scheme-authenticated credential, which typically results in higher approval rates and lower fraud rates.
Network tokens also provide domain restriction: a token issued for e-commerce use cannot be used at point of sale, and vice versa. This limits the damage if a token is compromised compared to an exposed raw PAN.
Why it matters
Higher authorisation rates on stored credentials: issuers approve network token transactions at higher rates than raw PAN transactions because the token signals scheme-level authentication. Merchants with high stored-credential volumes, subscriptions, one-click checkout, see measurable approval rate improvement from network token adoption.
Automatic card lifecycle management: when a cardholder's card is reissued or replaced, network tokens update automatically. This eliminates a major source of stored-credential declines and removes the need for account updater services on tokenized cards.
Reduced fraud liability on tokenized transactions: domain-restricted tokens limit reuse outside their intended context. A network token issued for a specific merchant's e-commerce transactions cannot be replayed at a different merchant or channel.
Migration from gateway tokens requires provider support: adopting network tokens typically requires the payment provider to have token service provider (TSP) agreements with Visa and Mastercard. Not all providers support network tokenisation, making it a meaningful differentiator at enterprise scale.
With PXP
PXP's Token Vault supports network token provisioning and lifecycle management for stored payment credentials across the platform. Merchants benefit from automatic credential updates and token portability across acquirer connections, reducing stored credential decay and improving authorisation rates on recurring charges.
Frequently asked questions
What's the difference between a network token and a gateway token?
A network token is issued and managed by the card network (Visa or Mastercard) and updates automatically when the underlying card changes. A gateway token is generated by a payment provider and is specific to that provider's system. Network tokens achieve higher approval rates because issuers recognise them as scheme-authenticated credentials; gateway tokens have no such signal.
Which payment providers support network tokenisation?
Network tokenisation requires the payment provider to be a registered token service provider (TSP) with Visa and Mastercard. Not all gateways and PSPs have TSP status. Merchants should confirm TSP registration when evaluating providers, particularly if stored-credential authorisation rates are a key metric.
How do network tokens affect subscription billing?
Network tokens significantly reduce subscription decline rates caused by card replacements and reissues. Because the token updates automatically when the cardholder gets a new card, recurring charges succeed without requiring the merchant to recollect payment details. For subscription businesses, this directly reduces involuntary churn from payment failures.
Are network tokens required for Apple Pay and Google Pay?
Yes. Apple Pay and Google Pay use network tokens as the underlying payment credential. When a cardholder adds a card to their device wallet, the wallet requests a network token from the relevant card network. The merchant never sees the raw PAN, only the device-specific network token, which is one reason why digital wallet transactions have lower fraud rates than standard card-not-present transactions.
Revolutionize your business with PXP
Take complete control of your commerce and payments with one platform.
Get Started