Understand how Stripe automatically provisions and uses network tokens for stored cards and how to inspect token status via card.networks
domain: Network-token provisioning · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
When a card is vaulted via Stripe (attached to a Customer or saved in the PaymentMethod vault), Stripe automatically attempts to enroll the PAN with the card network's token service on your behalf
No additional API calls are required to trigger provisioning; Stripe handles the token requestor registration and provisioning flow with Visa Token Service or Mastercard MDES
To check whether a network token is active, retrieve the PaymentMethod and inspect the card.networks object, which exposes the available and preferred network; Stripe also surfaces token-related details under card.wallet when applicable
When Stripe uses a network token for a transaction, the actual authorization flows through the token PAN (DPAN) rather than the original PAN, improving authorization rates and security
You do not need to manage cryptogram generation; Stripe generates the TAVV/DSRP cryptogram per-transaction using the provisioned token
Monitor the payment_method.updated webhook to detect when Stripe has refreshed or updated a stored card credential (including via account updater)
Known gotchas
Network token provisioning is not instantaneous; there may be a delay between card vaulting and token activation — Stripe may use the PAN for the first few charges before the token is ready
Not all card BINs support network tokenization; if the issuer or network does not support it, Stripe falls back to the PAN automatically without error
The card.networks field structure and available sub-fields may vary by API version; verify against current Stripe API docs to avoid parsing errors
Give your agent this knowledge — and 15,600+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?