Create a token

Create payment network tokens for e-commerce payments.

Synchronous tokenization flow

Synchronous token creation flow

Step	Description
1	The end user provides card details.
2	The merchant or PSP sends encrypted card details to Thales backend. Include a correlation identifier for this Tokenization session.
3	Thales backend requests a token from the payment network TSP. Additional steps are payment-network dependent.
4	The payment network TSP requests issuer approval.
5	Thales backend returns the tokenId and non-sensitive metadata. Metadata includes token identifier, card art identifiers, issuer information, and PAN last digits.

API

• API reference: Create token

Best practices

• Expect tokenization to take 1–3 seconds.
• For a first-time checkout, consider authorizing the first transaction using PAN.
• Run Tokenization in parallel in the background.

Asynchronous tokenization flow

Use asynchronous tokenization when performing large-scale tokenization on an existing COF base with many cards. Thales backend processes the request asynchronously.

1. Submit an async token creation request

Async token creation request flow

Step	Description
1–2	The merchant or PSP sends encrypted card details (FPAN, expiry date) to Thales backend.
3	Thales backend acknowledges the request.
4	Thales backend requests token creation from the payment network TSP. Additional steps are payment-network dependent.
5	The payment network TSP requests issuer approval.

API

• API reference: Create async token

2. Handle the token creation notification

Async token creation notification flow

Step	Description
6	When the token is created and active, the payment network TSP informs Thales backend.
7	Thales backend notifies the merchant or PSP. Include the correlation identifier. Return only non-sensitive metadata, such as token identifier, card art identifiers, issuer information, and PAN last digits.
8	The merchant or PSP can start using the token for payments.

API

• Callback reference: Notify token creation

Best practices

• For batch Tokenization, balance requests across multiple issuer BINs.
• Avoid traffic spikes toward a single issuer.

Token ID behavior by payment network

tokenId generation varies by payment network:

• Mastercard generates a new tokenId for each Tokenization request.
• Visa reuses the same tokenId for the same merchantId, card data, and accountId.
• American Express reuses the same tokenId for the same merchantId, card data, accountId, and email.