Manage Mastercard MDES network token lifecycle including token status webhooks and TAVV cryptogram usage
domain: developer.mastercard.com · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Enroll a PAN through your token requestor using the MDES Token Connect or Token Vault API; receive a token (DPAN) and the associated Token Unique Reference (TUR).
Store the TUR (not the raw DPAN) as your durable reference; use it to request cryptograms (TAVV) before each transaction submission.
Generate a TAVV by calling the MDES Transact API with the TUR and transaction data; the cryptogram is single-use and time-limited.
Include the DPAN, TAVV, and ECI indicator in the authorization request to the acquirer in place of the PAN.
Subscribe to MDES Token Status Webhook notifications to receive events for token suspension, deletion, or PAN-to-token mapping changes.
On receiving a token suspension event, pause recurring charges against that token and trigger re-enrollment or fallback to card-on-file PAN flow.
Known gotchas
TAVV cryptograms expire within seconds of generation; do not cache them — generate immediately before submitting each authorization.
Network tokens operate within the issuer's token domain; a token issued for e-commerce (domain 'ECOM') will be declined if submitted for a contactless (CONTACTLESS) transaction type.
MDES sandbox credentials and production credentials are completely separate environments; test token references cannot be promoted to production.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?