{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-docs/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Reefpay Docs","description":"Reefpay is the groundbreaking payment gateway that lets you integrate with the future of payments.","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"about-tokenization","__idx":0},"children":["About tokenization"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"how-tokenization-works","__idx":1},"children":["How tokenization works"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When a person provides a card number or bank account,","Reefpay"," stores the sensitive data in a PCI-compliant vault and returns a token — an opaque identifier that maps back to the original data. You store the token instead of the raw payment credentials."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"img","attributes":{"src":"https://files.modern-mermaid.live/images/1776270522624-mermaid-diagram-1776270522770.png","alt":"image"},"children":[]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The token format is ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["PAYMENT_TOKEN-"]}," followed by a 26-character alphanumeric string (for example, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["PAYMENT_TOKEN-01KFDKXMQ637EKEAY410MSQSXB"]},"). Tokens are not reversible — you cannot derive the original payment data from a token."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"why-tokenize","__idx":2},"children":["Why tokenize"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"reduce-pci-scope","__idx":3},"children":["Reduce PCI scope"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["PCI-DSS requires any system that stores, processes, or transmits cardholder data to meet strict security controls. By sending raw card data directly to","Reefpay"," and storing only the returned token, your systems never hold sensitive data. This dramatically reduces your compliance burden."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Without tokenization"},"children":["Without tokenization"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"With tokenization"},"children":["With tokenization"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Your servers store PANs and CVVs"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Only","Reefpay"," vault stores sensitive data"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Full PCI-DSS SAQ D assessment"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Reduced PCI-DSS SAQ A or SAQ A-EP"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Encryption, key management, access controls required on your side"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Token storage needs no special PCI controls"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Risk of data breach exposing payment data"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Breached tokens are useless to attackers"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"enable-recurring-and-returning-customer-payments","__idx":4},"children":["Enable recurring and returning-customer payments"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Tokens let you charge a person again without asking them to re-enter payment details. Store the token at account creation and reference it for future transactions."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"simplify-refunds-and-adjustments","__idx":5},"children":["Simplify refunds and adjustments"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Refund a previous transaction or issue a credit using the original token — no need to collect payment details again."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-gets-tokenized","__idx":6},"children":["What gets tokenized"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Paradise Pay tokenizes both card and bank account payment methods."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Payment method"},"children":["Payment method"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Sensitive fields stored in vault"},"children":["Sensitive fields stored in vault"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Returned in token response"},"children":["Returned in token response"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Card"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["PAN, expiry, CVV, cardholder name"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["payment_token"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["last_four"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["brand"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["bin"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["funding"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Bank account"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Account number, routing number"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["payment_token"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["last_four"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["account_type"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Sensitive fields are ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["write-only"]}," — the API never echoes back a full PAN, CVV, account number, or routing number in any response."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"creating-a-token","__idx":7},"children":["Creating a token"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"card-token","__idx":8},"children":["Card token"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"POST /v1/payment_tokens\n\n{\n  \"customer_id\": \"CUSTOMER-01KFDKXMQ637EKEAY410MSQSXB\",\n  \"is_default\": true,\n  \"nickname\": \"My Business Visa\",\n  \"card\": {\n    \"pan\": \"4111111111111111\",\n    \"expiry_month\": \"12\",\n    \"expiry_year\": \"2027\",\n    \"cardholder_name\": \"John A Doe\",\n    \"address\": {\n      \"line1\": \"123 Main St\",\n      \"zip\": \"62704\"\n    }\n  }\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"bank-account-token","__idx":9},"children":["Bank account token"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"POST /v1/payment_tokens\n\n{\n  \"customer_id\": \"CUSTOMER-01KFDKXMQ637EKEAY410MSQSXB\",\n  \"nickname\": \"Business Checking\",\n  \"bank_account\": {\n    \"routing_number\": \"021000021\",\n    \"account_number\": \"123456789012\",\n    \"account_type\": \"checking\",\n    \"name\": \"John Doe\",\n    \"email\": \"john.doe@example.com\"\n  }\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Both requests return a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["201 Created"]}," response with the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["payment_token"]}," and masked details."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"automatic-tokenization","__idx":10},"children":["Automatic tokenization"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When you process a transaction with raw card data (inline PAN),","Reefpay"," automatically tokenizes the card and includes the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["payment_token"]}," in the response. You can use this token for subsequent transactions without a separate tokenization call."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"id\": \"TRANSACTION-01JMRSPCK7XVNP3KS8F2W4T6Y\",\n  \"type\": \"sale\",\n  \"transaction_state\": \"authorized\",\n  \"payment_method\": {\n    \"type\": \"card\",\n    \"payment_token\": \"PAYMENT_TOKEN-01KFDKXMQ637EKEAY410MSQSXB\",\n    \"brand\": \"visa\",\n    \"last_four\": \"1234\",\n    \"bin\": \"411111\",\n    \"funding\": \"credit\"\n  }\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"using-a-token-in-a-transaction","__idx":11},"children":["Using a token in a transaction"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Reference the token instead of raw payment data."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"POST /v1/transactions\n\n{\n  \"type\": \"card_sale\",\n  \"amount\": 1999,\n  \"payment_method\": {\n    \"type\": \"token\",\n    \"payment_token\": \"PAYMENT_TOKEN-01KFDKXMQ637EKEAY410MSQSXB\"\n  }\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The gateway resolves the token to the stored card or bank account and processes the transaction."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"token-security-properties","__idx":12},"children":["Token security properties"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Opaque"]},": Tokens contain no encoded payment data; they are random identifiers."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Scoped"]},": Tokens are bound to a specific merchant (MID) and cannot be used across merchants."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Non-reversible"]},": There is no API to retrieve the original PAN or account number from a token."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Auditable"]},": Token creation, usage, and deletion events are logged for compliance."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"further-reading","__idx":13},"children":["Further reading"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/concepts/tokenization/stored-payment-methods"},"children":["About stored payment methods"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/concepts/security-compliance/pci-dss-overview"},"children":["About PCI-DSS compliance"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/concepts/security-compliance/data-protection"},"children":["About data protection"]}]}]}]},"headings":[{"value":"About tokenization","id":"about-tokenization","depth":1},{"value":"How tokenization works","id":"how-tokenization-works","depth":2},{"value":"Why tokenize","id":"why-tokenize","depth":2},{"value":"Reduce PCI scope","id":"reduce-pci-scope","depth":3},{"value":"Enable recurring and returning-customer payments","id":"enable-recurring-and-returning-customer-payments","depth":3},{"value":"Simplify refunds and adjustments","id":"simplify-refunds-and-adjustments","depth":3},{"value":"What gets tokenized","id":"what-gets-tokenized","depth":2},{"value":"Creating a token","id":"creating-a-token","depth":2},{"value":"Card token","id":"card-token","depth":3},{"value":"Bank account token","id":"bank-account-token","depth":3},{"value":"Automatic tokenization","id":"automatic-tokenization","depth":2},{"value":"Using a token in a transaction","id":"using-a-token-in-a-transaction","depth":2},{"value":"Token security properties","id":"token-security-properties","depth":2},{"value":"Further reading","id":"further-reading","depth":2}],"frontmatter":{"title":"About tokenization","shortTitle":"What is tokenization","intro":"Tokenization replaces sensitive payment data with a non-sensitive token. Tokens reduce PCI scope, simplify compliance, and let you charge stored payment methods without handling raw card numbers or bank accounts.","type":"overview","seo":{"title":""}},"lastModified":"2026-06-05T02:46:44.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/docs/concepts/tokenization/what-is-tokenization","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}