Gateway Tokenization

Create Gateway Tokens Without Handling Cardholder Data

HostedPCI Gateway Tokenization allows businesses to collect credit card information and generate payment tokens through supported payment gateways without requiring their applications to directly handle the original card details.

Using HostedPCI’s PCI DSS Level 1 Service Provider infrastructure, merchants can collect payment information through supported iFrame or IVR solutions and request a gateway-specific token through the HostedPCI API.

Businesses can continue using their preferred gateway’s tokenization and payment processing services while reducing unnecessary exposure to cardholder information.

Because HostedPCI maintains the original card information in its independent payment vault, businesses can also generate tokens with additional supported gateways without asking customers to re-enter their card details.

What Is Gateway Tokenization?

Gateway tokenization is the process of replacing credit card information with a token generated by a payment gateway.

The gateway token can be used for future transactions supported by that gateway without requiring the merchant to submit the original card number again.

However, obtaining a gateway token often requires the payment provider to receive the original card information.

HostedPCI acts as an intermediary between the merchant’s payment collection process and the payment gateway. HostedPCI collects and stores the card information, then communicates with the configured gateway to request a gateway-generated token.

The merchant receives the gateway token or continues using the HostedPCI token, depending on the integration.

This allows businesses to use gateway-specific tokenization without directly collecting or transmitting original card numbers through their own applications.

How HostedPCI Gateway Tokenization Works

Step 1: Collect Payment Information

Customers enter their credit card information through a supported HostedPCI payment iFrame, IVR solution, or other available collection method.

HostedPCI handles the original card information within its protected environment.

Step 2: Create a HostedPCI Token

HostedPCI tokenizes the collected payment information and provides a token that the merchant can use to reference the stored card.

The merchant can retain the HostedPCI token without storing the original card number.

Step 3: Request a Gateway Token

The merchant submits a gateway tokenization request through the HostedPCI API using the HostedPCI token and configured gateway profile.

HostedPCI retrieves the associated card information and communicates with the supported payment gateway to request a gateway-generated token.

The gateway creates the token according to its own tokenization requirements.

Step 4: Receive or Store the Gateway Token

The gateway token is either returned to the merchant for direct processing or maintained in association with the HostedPCI token, depending on the configured integration.

Two Gateway Tokenization Options

Option 1: Receive a Gateway Token for Direct Processing

A merchant collects payment information through HostedPCI and requests a gateway-generated token using the HostedPCI API.

The gateway token is returned to the merchant, allowing supported future transactions to be processed directly through the issuing payment gateway.

Because HostedPCI retains the original card information in its independent vault, the merchant can request a new token from another supported gateway later without asking customers to re-enter their card details.

This provides the convenience of direct gateway processing while preserving flexibility over payment providers.

Option 2: Maintain Gateway Tokens With HostedPCI

For supported configurations, HostedPCI can maintain gateway-generated tokens in association with the original HostedPCI vault token.

This allows businesses to use a consistent HostedPCI token while HostedPCI manages the related payment information and supported gateway tokens.

Organizations using multiple gateways can maintain centralized payment credentials instead of managing separate original card records within their applications.

Gateway-specific tokens remain subject to the requirements of the provider that issued them.

Gateway Tokens vs. HostedPCI Tokens

Although both token types help reduce direct exposure to payment card information, they serve different purposes.

Gateway Tokens

A gateway token is generated by a specific payment gateway and is generally intended for use within that provider’s payment processing environment.

It can support eligible future transactions without requiring the merchant to resubmit the original card number.

Gateway tokens are typically not interchangeable between unrelated payment providers.

HostedPCI Tokens

A HostedPCI token represents card information stored within HostedPCI’s independent payment vault.

The token can be used across supported HostedPCI integrations, allowing businesses to maintain a consistent reference to stored payment credentials.

Unlike a token generated by an individual gateway, the HostedPCI token is not tied exclusively to one payment provider.

This distinction allows merchants to use gateway tokenization where required while maintaining greater control over their stored payment information.

Key Features and Business Benefits

Secure Card Collection

Collect credit card information through HostedPCI’s supported iFrame and IVR integrations without requiring merchant applications to directly handle original card numbers.

Gateway Token Generation Through API

Request gateway-generated payment tokens through the HostedPCI Gateway Tokenization API.

HostedPCI handles the underlying card information and communicates with the configured payment gateway.

Maintain Existing Payment Workflows

Obtain gateway tokens required by supported payment providers while continuing to use existing gateway-based transaction processes.

Independent Payment Vault

HostedPCI stores cardholder information within its independent payment vault rather than exclusively with a single payment gateway.

This allows businesses to generate gateway-specific tokens when needed while retaining access to the underlying card information through HostedPCI’s supported integrations.

For recurring payments and stored-card transaction requirements, explore HostedPCI’s Credentials on File solution.

Multi-Gateway Token Management

For supported integrations, gateway-generated tokens can be associated with a HostedPCI vault token.

This allows businesses to manage payment credentials across different providers without maintaining separate original card records in their applications.

PCI DSS Scope Reduction

By using HostedPCI to collect and tokenize cardholder information, businesses can limit how much of their environment directly handles original credit card details.

This can help reduce PCI DSS scope depending on the integration and overall payment environment.

Gateway Tokenization does not eliminate a merchant’s remaining PCI DSS responsibilities.

Who Can Benefit From Gateway Tokenization?

E-commerce Businesses

Online retailers that use gateway-generated tokens for checkout and returning customer payments can collect payment information through HostedPCI while maintaining compatible gateway integrations.

SaaS, Software, and Subscription Platforms

Software providers and subscription businesses that require gateway-specific tokens for stored-card transactions can use HostedPCI to collect and tokenize payment credentials without directly handling original card numbers.

For recurring billing requirements, HostedPCI’s Credentials on File solution supports eligible stored-credential transaction workflows.

Enterprise Businesses Using Multiple Gateways

Organizations working with multiple payment providers can maintain an independent HostedPCI vault while supporting gateway-specific tokenization requirements.

Use Case: Creating Gateway Tokens for a SaaS Payment Platform

A SaaS company offers payment functionality to its customers through an existing payment gateway.

The gateway supports stored-card transactions using its own tokens, but the SaaS company wants to avoid collecting original cardholder information directly through its application.

With HostedPCI Gateway Tokenization:

1. Collect: The customer enters credit card information through a HostedPCI iFrame integrated into the SaaS platform.
2. Tokenize: HostedPCI stores the original card information and provides a HostedPCI token.
3. Request: The SaaS platform submits a gateway tokenization request through the HostedPCI API.
4. Generate: HostedPCI communicates with the configured gateway, which creates its gateway-specific token.
5. Return: The gateway token is returned to the SaaS platform for use in supported future transactions.
6. Process: The SaaS platform continues processing payments directly through its gateway using the gateway-generated token.

The SaaS company maintains its existing payment workflow while limiting direct handling of cardholder data.

If the business introduces additional payment gateways, HostedPCI’s independent vault can support new gateway tokenization requests without asking customers to re-enter their card details.

Need gateway tokens without collecting cardholder data directly?

Contact HostedPCI to discuss your gateway tokenization and integration requirements.

Gateway Tokenization FAQs

What is gateway tokenization?

Gateway tokenization replaces original credit card information with a token generated by a payment gateway.

The token can be used for supported future transactions within that gateway’s payment environment without submitting the original card number again.

How does HostedPCI Gateway Tokenization work?

HostedPCI collects and stores payment card information through a supported integration and provides a HostedPCI token.

The merchant uses that token to request a gateway-generated token through the HostedPCI API.

Depending on the integration, the gateway token is returned to the merchant or maintained in association with the HostedPCI token.

Can I receive a gateway token without processing a payment?

Yes, where the gateway supports it.

HostedPCI’s gateway tokenization requests can be separate from standard sale or authorization transactions.

Some gateways may require an account verification or other processing step before generating a token. Available functionality depends on the gateway’s API requirements.

Can I process payments directly with my gateway token?

Yes, where supported by the gateway.

Businesses can receive a gateway-generated token through HostedPCI and use it for eligible transactions submitted directly to the issuing gateway.

Payment processing requirements are established by the gateway.

What is the difference between a HostedPCI token and a gateway token?

A HostedPCI token represents payment card information stored within HostedPCI’s independent vault.

A gateway token is issued by a particular payment provider and is generally intended for use within that provider’s processing environment.

HostedPCI tokens support payment workflows across compatible integrations, while gateway tokens remain subject to the requirements of the issuing gateway.

Does HostedPCI support gateway tokenization with multiple payment gateways?

Yes. HostedPCI supports gateway tokenization through multiple payment provider integrations.

For supported configurations, gateway-generated tokens can be associated with a HostedPCI token to help businesses manage payment credentials across different providers.

Available functionality depends on the gateway and integration requirements.

Can I change payment gateways without collecting customer cards again?

Yes, in many cases.

Because HostedPCI maintains the original card information within its independent vault, businesses can request gateway tokens from additional supported payment providers without asking customers to re-enter their card details.

The new gateway may require additional tokenization, account verification, or configuration steps.

Are gateway tokens interchangeable between payment providers?

Generally, no.

A gateway token is typically specific to the payment provider that issued it.

HostedPCI’s independent tokenization infrastructure helps businesses maintain access to stored payment information across supported gateway integrations without relying exclusively on a single gateway token.

Which payment gateways support Gateway Tokenization?

HostedPCI supports gateway tokenization through selected integrations, including Authorize.Net, Stripe, Network Merchants (NMI), Payroc, and Global Payments (Realex).

Supported token types and API requirements vary by gateway.

For Stripe integrations that require HostedPCI to submit raw card data to Stripe’s API, the Stripe account may need approval for raw card data API access before gateway tokenization can be enabled.

Businesses should confirm provider-specific requirements during integration planning.

Does gateway tokenization reduce PCI DSS scope?

Gateway Tokenization can help reduce PCI DSS scope by allowing businesses to collect cardholder information through HostedPCI and use tokens within their applications instead of original card numbers.

Actual scope reduction depends on the payment architecture, integration, and merchant’s remaining compliance responsibilities.

Is HostedPCI a payment gateway or processor?

No. HostedPCI is not a payment gateway or payment processor.

HostedPCI provides payment collection, tokenization, payment vaulting, and gateway integration infrastructure.

Merchants maintain their relationships with their selected payment gateway providers.

Support Gateway Tokenization With HostedPCI

HostedPCI Gateway Tokenization allows businesses to collect payment information, create gateway-generated tokens, and maintain existing payment workflows without directly handling original card numbers in their applications.

Whether you need a gateway token for direct processing or want to maintain payment credentials across multiple supported gateways, HostedPCI provides tokenization and integration options tailored to your requirements.

Contact HostedPCI to discuss your gateway tokenization requirements.

Explore HostedPCI Gateway Tokenization API Documentation for technical integration details.