Payment Token

A payment token is a unique, randomly generated identifier that substitutes for a customer's actual payment credentials, most commonly the Primary Account Number (PAN), allowing payment methods to be stored, referenced, and reused without exposing the underlying sensitive data. When a customer saves a card for future purchases, what is stored and referenced in subsequent transactions is the payment token, not the card number itself.

Payment tokens have no mathematical relationship to the underlying card data they represent, knowing the token does not allow you to derive the PAN or any other sensitive credential. This is what makes tokenization fundamentally different from encryption: an encrypted value can be decrypted if the key is obtained, but a token is simply a reference with no decryptable content. The mapping between the token and the underlying data is maintained securely by the vault provider.

It is important to distinguish between the different types of payment tokens in use:

A **vault token** (or payment method token) is issued by a Payment Vault provider such as Spreedly. It is a reference to the payment method record stored in the vault and is specific to that vault system. It can be used to process transactions through any gateway connected to the vault.

A **Network Token** is issued by a card network (Visa Token Service, Mastercard Digital Enablement Service). It is a credential recognized by the card network's authorization infrastructure and carries cryptographic authentication that improves authorization rates.

A **gateway token** is issued by a specific gateway and can only be used to process transactions through that gateway, the most limiting form of tokenization from a portability standpoint.

Understanding which type of token is in use matters because it determines portability, lifecycle management requirements, and authorization performance.