Initiate token provisioning by submitting a card enrollment request to your network's Token Requestor (TR) registration — this includes the PAN, expiry, and billing address to the Token Service Provider (Visa Token Service or Mastercard MDES).
Receive the token (DPAN), the associated token expiry, and a token cryptogram specification; store the DPAN in your vault mapped to the original account reference but never store the cryptogram — it is single-use.
Generate a fresh transaction cryptogram (TAVV for Visa or DSRP cryptogram for Mastercard) for each authorization by calling the cryptogram generation endpoint with the DPAN, amount, and transaction data.
Submit the authorization with the DPAN in the card number field and the cryptogram in the appropriate EMV data field; indicate tokenized payment with the correct token indicator in your processor's authorization message.
Handle token lifecycle events via webhooks or polling: token status changes (active, suspended, deleted), FPAN updates (card reissue or expiry), and token refresh requests from the network.
When a token is suspended or deleted, trigger re-enrollment or fall back to prompting the cardholder to re-enter card details; do not retry with a suspended DPAN.
Known gotchas
Cryptograms are single-use and time-bound; storing and reusing a cryptogram will result in a decline on the second authorization.
Token provisioning requires the card to be enrolled with the issuer; not all cards are eligible for network tokenization, and the enrollment response will indicate if the PAN cannot be tokenized.
DPAN-to-FPAN mapping is maintained by the Token Service Provider, not by your vault; when the underlying FPAN changes (reissue), the TSP updates the mapping automatically and notifies you via lifecycle webhooks — you must handle these to avoid stale authorizations.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp