Skip to main content
Network tokens are payment credentials issued directly by card schemes — Visa, Mastercard, American Express — as replacements for the actual card number (PAN). Instead of the raw PAN, transactions use a scheme-issued Token PAN (TPAN) scoped to a specific card and merchant context. Both Guardian and Commerce support network tokens. Lifecycle management — including updates when cards expire or are re-issued — is handled automatically by the platform. Benefits
  • Higher authorization rates — scheme-recognized tokens are treated as lower-risk and authorize at higher rates than raw PANs
  • Reduced fraud — tokens are scoped to a specific merchant and cannot be reused outside that context
  • Lower interchange fees — some schemes offer preferential rates for network token transactions
  • PSP portability — a single network token can be used with multiple PSPs

Flows

Create a Network Token

When you tokenize a card, Hellgate requests a network token from the card scheme. The scheme provisions a TPAN bound to the card and your merchant, which Hellgate associates with the token.

Customer Initiated Transaction (CIT)

When a cardholder is present at checkout, a cryptogram must be requested before authorization. The cryptogram is a one-time proof of token ownership that your PSP uses to validate the transaction.

Merchant Initiated Transaction (MIT)

For recurring charges where the cardholder is not present — subscriptions, installments, deferred billing — the scheme manages the TPAN lifecycle automatically. Most processors do not require a new cryptogram for MIT, simplifying the authorization flow.
MIT cryptogram requirements vary by processor. Check your PSP’s documentation for their specific requirements for recurring network token transactions.

Supported Schemes

  • Visa
  • Mastercard
  • American Express
  • Discover (coming soon)
  • Diners Club (coming soon)

Guardian and Commerce

Both products support network tokens, but handle the relationship to PCI tokens differently:
GuardianCommerce
ProvisioningExplicit — provisioned separately from PCI tokensAutomatic — provisioned when you create a Commerce token (if enabled for your account)
Token lifecycleIndependent — PCI token and network token lifecycles are separateUnified — network token lifecycle is aligned with the Commerce token

Get Started