Skip to main content
PCI Booking helps Online Travel Agencies (OTAs) handle payment card data while keeping it out of their own systems. Whether you need to capture cards from travelers, relay card details to hotels, or charge cards through your payment gateway, PCI Booking acts as a secure middleman so sensitive data never touches your servers. With PCI Booking, your OTA can tokenize cards at the point of booking, store them securely, and use tokens to process payments or forward card data to accommodation providers. This keeps card data out of your systems and reduces your PCI DSS scope. See PCI Scope and Compliance for what remains yours.

​
Where to Start

How PCI Booking Works

Understand the tokenization flow and how PCI Booking fits into your booking pipeline.

Quickstart Guide

Get up and running with your first integration in minutes.

Capture Cards from Travelers

Embed a secure card entry form in your checkout flow to tokenize card data.

Card By Link

Send a secure link via email or SMS so travelers can enter card details for phone bookings.

Send Cards to Hotels

Choose how each hotel receives the card: secure view link, your extranet, or the hotel’s API.

Charge via Payment Gateway

Process charges through 100+ supported payment gateways using stored tokens.

PSD2/SCA Compliance

Implement Strong Customer Authentication to meet PSD2 requirements.

PCI Scope and Compliance

How integrating PCI Booking affects your PCI DSS scope and which SAQ applies to you.

Common Use Cases

Browse step-by-step workflows for OTA scenarios like capture-and-relay and capture-and-charge.

​
Typical OTA Workflows

  • Capture and share with the hotel: Tokenize the traveler’s card at booking, then give the hotel secure access to the card. See Send a Guest’s Card to a Hotel.
  • Capture and charge: Tokenize the card and process a charge through your payment gateway in a single flow. See Capture and Charge.
  • Phone bookings: Use Card By Link to send a secure card capture form to travelers who book by phone. See Card By Link.

​
Testing Your Integration

Before going live, use PCI Booking’s sandbox environment to validate your integration end to end. See Testing and Going Live.