Wallet Tokens with Google Pay
Guardian now accepts device wallet payments, starting with Google Pay. Pass the encrypted Google Pay payload straight to Guardian — it verifies the ECv2 signature chain, decrypts, and stores the credential server-side, so the decrypted card data never touches your systems. From there you can forward the resulting wallet token to your PSP or acquirer, and promote a card-on-file (PAN_ONLY) token to a full network
token. See Google Pay
to get started.JWT Authentication
A new JWT authentication lane runs in parallel to API keys. Guardian validates incoming tokens against your JWKS endpoint, letting you authenticate services with short-lived JWTs instead of, or alongside, long-lived API keys.Network Token Cryptogram Forwarding
You can now forward a network token cryptogram by reference onPOST /api/network/tokens/{id}/forward, so Guardian resolves the cryptogram
server-side and it never touches your systems. Forward templates also expose
more binds — including dynamic_cvv and additional network token fields — for
richer downstream requests.Token Lifecycle Controls
New token lifecycle controls let you set and manage expiration on stored tokens. Guardian accepts anexpiration_time alias for expires_in, and a
session’s expires_in now consistently takes precedence over the ephemeral
payload flag.Improvements and bugfixes
- Guardian now detects PANs in non-PAN attributes, catching card data that would otherwise slip through in the wrong field.
- Ingress forwarding headers are no longer relayed to destinations, keeping internal routing headers out of your outbound proxy requests.
- Network token create responses now serialize
pci_token_id. - Clearer proxy template errors: Guardian returns
422when a placeholder resolves to a map, validates unwrap placeholders inside multi-part templates, and gives more precise messages for non-renderable placeholders. - Ephemeral sessions without an
expires_inare handled correctly.
Guardian Admin UI
Guardian now ships with a built-in Admin UI for day-to-day token operations. Browse and manage tokens, handle API keys with proper timezone-aware expiration, and walk new operators through token creation — all backed by a Playwright end-to-end test suite so it stays solid release after release.Metadata Inquiry Endpoint
A newPOST /metadata/inquiry endpoint lets you look up issuer metadata
on-demand. The endpoint is feature-flagged per tier, propagates the
x-request-id end-to-end as a correlation ID, and emits a billing event
tagged with the requester’s contract ID — so reporting and chargeback
reconciliation work out of the box.Improvements and bugfixes
- American Express now renders with its proper scheme name in admin views.
- Metadata inquiry events include
network_token_idfor richer reconciliation data. - Hellgate SDK
<script>tag no longer carries SRI/crossoriginattributes, simplifying embedding.
Token Import
Migrating into Guardian from a legacy vault just got dramatically easier. A new admin Tokens Import workflow lets you bulk-load tokens via SFTP, with vault key handling that accepts both PEM and OpenSSH key formats. Move large token estates in hours, not weeks.Improvements and bugfixes
- Vault error handling is now much more informative — fewer mystery failures, more actionable messages.
- Clearer error response when creating a PCI token with invalid input.
Generic Token Types API
Building on January’s Generic Tokens launch, you can now manage token type definitions through a new admin API:GET /api/admin/types,
GET /api/admin/types/{id}, and DELETE /api/admin/types/{id}. Type
schemas are validated at token-creation time, and you can filter your
generic tokens by type_id — making it straightforward to organize
SEPA credentials separately from API keys, for example.Improvements and bugfixes
- PCI token limits are now checked before network tokenization, avoiding half-completed states when a tenant hits its cap.
- Network token status is validated before cryptogram creation, surfacing a clean error instead of an opaque failure deep in the cryptogram path.
- Token requestor returns proper user-facing error messages.
404response shape is now consistent across the API.- Completed sessions return a sensible response even when the network token attempt failed.
- Added PAYONE test cards to the test fixtures.
Introduction of Generic Tokens
Effecitve with this release, you can now store arbitrary payloads (for example SEPA credentials, API keys, or other sensitive data). Find more information in our documentation.Improved TMS Support
The integration of VISA Token Management Service (TMS) was update for better feature coverage and more flexibility.Added support for VISA Token Management Service (TMS)
Effecitve with this release another backend for network token management was added. This brings more options and better flexibility.Bugfixes
- Allow deletion of network tokens in case of active cryptograms.
- Better handling of image dimensions of card-art data.
- Better error messages for missing data in scheme cryptograms.