Manage the network token lifecycle: provision, update, and use tokens via token vault concepts

Steps

1. Initiate token provisioning by submitting a card enrollment request to your network's Token Requestor (TR) registration — this includes the PAN, expiry, and billing address to the Token Service Provider (Visa Token Service or Mastercard MDES).
2. Receive the token (DPAN), the associated token expiry, and a token cryptogram specification; store the DPAN in your vault mapped to the original account reference but never store the cryptogram — it is single-use.
3. Generate a fresh transaction cryptogram (TAVV for Visa or DSRP cryptogram for Mastercard) for each authorization by calling the cryptogram generation endpoint with the DPAN, amount, and transaction data.
4. Submit the authorization with the DPAN in the card number field and the cryptogram in the appropriate EMV data field; indicate tokenized payment with the correct token indicator in your processor's authorization message.
5. Handle token lifecycle events via webhooks or polling: token status changes (active, suspended, deleted), FPAN updates (card reissue or expiry), and token refresh requests from the network.
6. When a token is suspended or deleted, trigger re-enrollment or fall back to prompting the cardholder to re-enter card details; do not retry with a suspended DPAN.