Network tokens overview
Network tokens can be used to process payments on supported payment gateways, helping improve payment security, authorization success rates, and continuity for recurring or stored credential transactions.
A network token is a 16-digit surrogate card number issued by card networks (Visa, Mastercard, Amex, Discover) that securely replaces the actual card number (PAN) for transactions. It can improve transaction security and support reliable recurring payments.
Only the requesting merchant can use the token; if compromised, it cannot be used by other merchants.
Benefits of network tokens
- Reduced potential fraud: Network tokens replace card details during transactions, which reduces exposure to sensitive payment data.
- Minimum integration effort: Network token support fits into existing card payment flows with minimal additional integration.
- Reduced payment failures: Network tokens are persistent when the referenced card changes leading to a reduced decline rate.
- Reliable recurring payments: Network tokens support recurring and future use cases in which stored payment credentials are reused over time.
Comparison of token types
The following table compares one-time use tokens, vaulted tokens, and network tokens.
| Token type | Description |
|---|---|
| One-time use token | A token created for a single checkout or payment session. A new token is required for each new checkout session. |
| Vaulted token | A token created when a payment method is enrolled and stored with customer information. Merchants use it to identify the stored payment method in future payments. |
| Network token | A network-issued surrogate for card data that is used instead of the underlying card number in payment transactions. |
When network tokens are activated, Zuora generates network tokens for cards that are enrolled and securely stored for future use. Cards that are not stored for future use, such as one-time-use cards, are excluded from this process.
Network token lifecycle
A network token can have one of the following statuses:
| Status | Description |
|---|---|
| Created | The network token is created. |
| Active | The network token is active and can be used for payments. |
| Suspended | The network token is suspended, for example, when the issuer blocks payments for a specific merchant. |
| Canceled | The network token is canceled, for example, when the associated card account is closed. |
Zuora receives token lifecycle updates from the card network, ensuring account information stays up-to-date.
How provisioning works
Zuora provisions network tokens at the time of vaulting.
- Initial authorization: The first authorization always processes using the Primary Account Number (PAN). The network token is established and used from the second transaction onward. If you inspect a newly vaulted payment method immediately and do not see a token, this is the expected behavior.
- Enrollment: Card enrollment routes through Zuora's tokenization path, regardless of your gateway routing configuration.
Duplicate enrollments
If the same card is enrolled multiple times, each enrollment creates a distinct vaulted token. For network tokens, Zuora uses a network token fingerprint that is scoped to your organization and to the unique identifier of the network token in the PCI vault. As a result, duplicate enrollments for the same card can map to the same network token. Merchants can use card fingerprint data to identify vaulted-token duplicates on their side.
Use of network tokens in Modernized Zuora Payments
In Modernized Zuora Payments, you can either let Zuora provision network tokens or supply your own existing network tokens.
In the Modernized Zuora Payments experience, you can use network tokens in one of the following ways:
- Allow Zuora to provision and collect network tokens
- Use your own (merchant-supplied) network tokens
- Migrate WorldPay Network Payment Tokens (NPT)
Zuora-provisioned network tokens
Zuora can obtain network tokens from participating card networks and use them instead of the underlying card details during authorization. No separate payment-flow integration is required for this option. You can continue to use the standard card payment workflow for your integration while Zuora handles token substitution as part of payment processing.
To activate this capability, contact Zuora Global Support to provision or request the required credentials.
The following information is required to set up your account to provision network tokens through Zuora:
Client
Company Legal Name
Website
Required Provider
Company Registered Country
Company Registered State
Company Registered Address
Company Registered ZIP Code
Company Registered Phone
Primary Contact First Name
Primary Contact Last Name
Business Identification Type
Business Identification Number
Merchant-supplied network tokens
You can also process payments using an existing network token that was generated outside of Zuora.
If you want to migrate existing network tokens to Zuora while maintaining your existing Token Requestor Identifier (TRID), you will need to perform a TRID migration. To initiate this process, contact Zuora Global Support.
If you do not want to migrate existing network tokens, you can allow Zuora to issue new network tokens for you.
Migrate WorldPay Network Payment tokens
If you have an existing relationship with WorldPay for the Network Payment Token (NPT) product, you can choose to migrate those network tokens to Zuora, or allow Zuora to issue new network tokens.
To migrate it to Zuora, contact Zuora Global Support.