Migrate a PAN vault to network tokens using Checkout.com Token Migration API without re-collecting card data
domain: www.checkout.com/docs · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Inventory all stored PANs in your vault and classify them by card brand and originating PSP
Enroll in Checkout.com's network tokenization program and obtain the token requestor ID for each supported card brand
Call the Checkout.com Token Migration API endpoint in batch mode, submitting encrypted PAN records using the token requestor keys
Receive the network token and token expiry for each successfully migrated card; store DPAN alongside original vault reference
Update your charge path to pass the network token plus a TAVV cryptogram generated for each authorization request
Run parallel authorization tests comparing approval rates on legacy PAN charges versus network-tokenized charges
Known gotchas
Card brands have different migration batch size limits and may require a signed agreement before the token requestor ID is provisioned
The cryptogram (TAVV or CAVV depending on brand) is single-use and time-bound; generating it too early before the authorization attempt causes a decline
Not all issuing banks participate in token migration; retain a fallback path to charge the original PAN for non-tokenizable cards
Give your agent this knowledge — and 15,600+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?