API Tokenization and Secure Vaulting
Tokenize Credit Card Data Without Replacing Your Existing Payment Collection Process
HostedPCI’s API Tokenization solution allows businesses to tokenize credit card information through a direct API integration while maintaining their existing checkout pages, applications, and payment collection processes.
Once a merchant collects card information, it can submit the details to HostedPCI’s tokenization API and receive a token representing the original Primary Account Number (PAN).
HostedPCI stores the original card number within its protected payment vault, allowing merchants to use tokens for supported payment transactions without retaining raw card numbers in their own systems.
This approach is designed for businesses that need to maintain their existing payment collection methods while outsourcing sensitive card data storage.
What Is Credit Card API Tokenization?
Credit card API tokenization replaces a card number with a token that represents the original payment information.
Rather than retaining the original PAN within their applications, merchants can use the HostedPCI token for subsequent supported payment transactions.
HostedPCI maintains the original card number within a merchant-designated payment vault.
API Tokenization is particularly useful for organizations that already collect credit card information through their own systems and want to reduce the need to store sensitive cardholder data internally.
How Does HostedPCI API Tokenization Work?
HostedPCI provides an API-based approach to tokenizing cardholder information after it has been collected by the merchant.
1. Collect Credit Card Information
The merchant collects credit card details through its existing checkout page, application, or telephone payment workflow.
2. Submit Card Information Through the API
The merchant submits the collected card information to HostedPCI using the API Tokenization service.
HostedPCI supports a direct, one-step API tokenization process and an alternative two-step setup and mapping process.
3. Receive a HostedPCI Token
HostedPCI generates a token representing the original card number and returns it to the merchant’s application.
The original PAN is maintained within HostedPCI’s payment vault.
4. Use the Token for Payment Processing
The merchant can use the token in supported payment transactions through HostedPCI’s Payment API.
HostedPCI resolves the token and forwards the required payment information to the configured payment gateway without requiring the merchant to retrieve the original PAN.
View API Tokenization Documentation
Key Features of HostedPCI API Tokenization
Direct API Credit Card Tokenization
Submit collected credit card information through a direct API call and receive a HostedPCI token.
A two-step tokenization process is also available for implementations that require a setup and mapping workflow.
Secure Card Vault Storage
HostedPCI maintains original credit card numbers within its protected payment infrastructure.
Each merchant is assigned a designated vault for storing its tokenized card data.
Configurable Credit Card Tokens
HostedPCI’s standard token format is 16 digits long, retaining the first four and last four digits of the original card number.
The remaining eight digits are generated as replacement values.
Token formats can be customized according to supported merchant requirements, allowing organizations to align token references with their existing applications.
Integration With Existing Payment Systems
API Tokenization allows businesses to maintain their established checkout pages and payment collection workflows.
Merchants can introduce tokenization without necessarily changing how customers enter their payment information.
Token-Based Payment Transactions
Once generated, HostedPCI tokens can be referenced for supported payment transactions through the Payment API.
This allows businesses to use stored payment information without maintaining the original card number within their applications.
Multiple Payment Gateway Support
HostedPCI supports integrations with multiple payment gateways, allowing merchants to use their configured payment processing providers alongside HostedPCI’s tokenization infrastructure.
Explore Supported Payment Gateways
API Tokenization vs. eCommerce iFrame Tokenization
HostedPCI offers different approaches to collecting and tokenizing credit card information.
API Tokenization
With API Tokenization, the merchant collects credit card details through its existing systems before submitting the information to HostedPCI.
This approach is designed for organizations that want to retain their current payment collection process while outsourcing storage of the original card numbers.
eCommerce iFrame Tokenization
With HostedPCI’s eCommerce iFrame, customers enter payment details directly into HostedPCI-hosted fields embedded within the merchant’s website.
Cardholder information is collected by HostedPCI rather than passing through the merchant’s application servers.
This can help reduce the merchant’s exposure to sensitive cardholder information during payment collection.
PCI DSS Considerations for API Tokenization
HostedPCI provides card storage and tokenization services through PCI DSS Level 1 validated infrastructure.
API Tokenization allows merchants to avoid retaining original card numbers within their own applications while continuing to use existing payment collection processes.
However, API Tokenization does not automatically remove the merchant’s payment collection systems from PCI DSS scope.
Because the merchant initially collects and transmits cardholder information, the systems involved in that process remain subject to applicable PCI DSS requirements.
The overall compliance responsibilities depend on the merchant’s payment environment and implementation.
Frequently Asked Questions
What is credit card API tokenization?
Credit card API tokenization replaces a collected card number with a token that can be referenced for supported payment transactions without storing the original PAN in the merchant’s application.
Can I use HostedPCI API Tokenization with my existing checkout?
Yes. API Tokenization is designed for merchants that already collect card information and want to maintain their existing payment collection process.
How does HostedPCI store the original credit card information?
HostedPCI stores original card numbers within its protected payment vault. Each merchant receives a designated vault environment for its card data.
Can I customize the token format?
Yes. HostedPCI offers a standard 16-digit token format that preserves the first four and last four digits of the card number, with customization available for supported requirements.
Does HostedPCI support one-step API tokenization?
Yes. HostedPCI supports a direct one-step API tokenization call, as well as an alternative two-step setup and mapping process.
Can HostedPCI tokens be used for future transactions?
Yes. HostedPCI tokens can be referenced in subsequent supported payment transactions through the Payment API, subject to the configured gateway and applicable payment requirements.
Does API Tokenization eliminate PCI DSS requirements?
No. Although merchants can outsource storage of the original card numbers, systems that initially collect and transmit cardholder information remain subject to applicable PCI DSS requirements.
What is the difference between API Tokenization and iFrame Tokenization?
API Tokenization allows merchants to collect card information through their own systems and then submit it to HostedPCI.
iFrame Tokenization collects card details directly through HostedPCI-hosted fields, helping limit exposure to cardholder data within merchant application servers.
Protect Credit Card Data With HostedPCI API Tokenization
Keep your existing payment collection workflows while reducing the need to store sensitive cardholder information within your applications.
HostedPCI combines direct API tokenization, secure card vaulting, and token-based payment processing to help businesses manage credit card data through their existing payment infrastructure.
Contact HostedPCI to discuss your API Tokenization requirements.