> ## Documentation Index > Fetch the complete documentation index at: https://developer.hellgate.io/llms.txt > Use this file to discover all available pages before exploring further. # Overview > Network tokens replace card PANs with scheme-issued tokens for improved security and authorization rates. Supported across Guardian and Commerce. Network tokens are payment credentials issued directly by card schemes — Visa, Mastercard, American Express — as replacements for the actual card number (PAN). Instead of the raw PAN, transactions use a scheme-issued **Token PAN (TPAN)** scoped to a specific card and merchant context. Both [Guardian](/products/guardian/tokens/network-tokens) and [Commerce](/products/commerce/v2/tokens/network) support network tokens. Lifecycle management — including updates when cards expire or are re-issued — is handled automatically by the platform. Hellgate is a certified **Token Service Provider (TSP)** with the card schemes. As part of enabling network tokens, we register and onboard your business with the schemes on your behalf — so you receive scheme-issued tokens without holding your own token requestor certification or managing scheme enrollment yourself. **Benefits** * **Higher authorization rates** — scheme-recognized tokens are treated as lower-risk and authorize at higher rates than raw PANs * **Reduced fraud** — tokens are scoped to a specific merchant and cannot be reused outside that context * **Lower interchange fees** — some schemes offer preferential rates for network token transactions * **PSP portability** — a single network token can be used with multiple PSPs * **Fully managed onboarding** — as a certified TSP, Hellgate handles scheme registration and merchant onboarding for you ## Flows These flows show how a network token is created and used across a card's lifecycle, with Hellgate shown as a single actor. The exact API calls depend on the product — see [Guardian and Commerce](#guardian-and-commerce) for how each one provisions network tokens. ### Create a Network Token When you tokenize a card, Hellgate requests a network token from the card scheme. The scheme provisions a TPAN bound to the card and your merchant, which Hellgate associates with the token. ```mermaid theme={null} sequenceDiagram autonumber participant M as Merchant participant H as Hellgate participant S as Card Scheme M->>+H: Tokenize card H->>+S: Provision network token S->>-H: Token PAN (TPAN) H->>-M: Token (enriched with network token) ``` ### Store Credentials at Checkout When a merchant wants to store a card on file, the first authorization can run on the raw card number (FPAN) and the network token is provisioned only after that authorization succeeds. Provisioning a network token calls out to the card scheme and can add noticeable latency, so it should not be wired directly into the checkout path — authorize on the FPAN first to keep checkout fast, then provision the network token out of band once the payment is approved. ```mermaid theme={null} sequenceDiagram autonumber participant M as Merchant participant H as Hellgate participant P as PSP participant S as Card Scheme M->>+H: Tokenize card H->>-M: Token (FPAN) M->>+P: Authorize first payment with FPAN P->>-M: Authorization approved Note over M,S: Provision off the checkout path M->>+H: Provision network token from the stored card H->>+S: Provision network token S->>-H: Token PAN (TPAN) H->>-M: Network token ready for future payments ``` ### Customer Initiated Transaction (CIT) When a cardholder is present at checkout, a cryptogram must be requested before authorization. The cryptogram is a one-time proof of token ownership that your PSP uses to validate the transaction. ```mermaid theme={null} sequenceDiagram autonumber participant C as Customer participant M as Merchant participant H as Hellgate participant S as Card Scheme participant P as PSP C->>M: Initiate payment M->>+H: Request payment data H->>+S: Generate cryptogram S->>-H: Cryptogram H->>-M: TPAN + Cryptogram M->>+P: Authorize with TPAN + Cryptogram P->>-M: Authorization result M->>C: Payment confirmed ``` ### Merchant Initiated Transaction (MIT) For recurring charges where the cardholder is not present — subscriptions, installments, deferred billing — the scheme manages the TPAN lifecycle automatically. Most processors do not require a new cryptogram for MIT, simplifying the authorization flow. ```mermaid theme={null} sequenceDiagram autonumber participant M as Merchant participant H as Hellgate participant P as PSP M->>+H: Retrieve token H->>-M: Current TPAN M->>+P: Authorize with TPAN P->>-M: Authorization result ``` MIT cryptogram requirements vary by processor. Check your PSP's documentation for their specific requirements for recurring network token transactions. ## Supported Schemes * Visa * Mastercard * American Express * Discover *(coming soon)* * Diners Club *(coming soon)* ## Guardian and Commerce Both products support network tokens, but handle the relationship to PCI tokens differently: | | Guardian | Commerce | | --------------- | ----------------------------------------------------------------- | -------------------------------------------------------------------------------------- | | Provisioning | Explicit — provisioned separately from PCI tokens | Automatic — provisioned when you create a Commerce token (if enabled for your account) | | Token lifecycle | Independent — PCI token and network token lifecycles are separate | Unified — network token lifecycle is aligned with the Commerce token | Provisioning sources, cryptogram types, and API usage. Automatic provisioning, cryptogram request workflow, and PSP integration. ## Get Started Enable network tokens for testing and production. Add-on feature — requires activation. Test provisioning and cryptogram generation with the built-in Network Token Sandbox.