How token sharing works between merchants
- Company A tokenizes the card and owns the token.
- Company A associates the token with Company B.
- Company B can now perform actions on the token (charge, relay, display, etc.) as if they created it.
- Company A retains ownership and responsibility, and pays the storage.
Step 1: Tokenize the Card
Company A tokenizes the card using any available method:- Hosted Card Entry Form
- Card By Link
- Tokenization on Response
- Tokenization on Request
- Universal Tokenization
Step 2: Associate the Token with Company B
Company A calls Associate with Customer to grant Company B access to the token. After association, Company A sends Company B the token URI. The token URI is not sensitive data and can be shared through any channel (email, API, etc.).Step 3: Company B Uses the Token
Once associated, Company B can perform any action on the token:- Charge via Universal Payment Gateway
- Relay to a third party via Token Replacement
- View card details via Card Display
- Share it onward with another PCI Booking customer, see Sharing Onward
Ownership stays with Company A. Company A pays the storage, and is billed for some actions even when Company B performs them, such as relays and card display. Other actions, such as charges, are billed to the account that performs them. See Billing on a Shared Token. The CVV retention policy also stays with Company A: only Company A can set it.
Step 4: Remove Access
When Company B no longer needs access, Company A calls Disassociate from Customer to revoke access. Only the owner can remove an association.Related
- Working with Third Parties. All the ways to work with a partner on a card, compared.
- Third-Party Permissions. Overview of property and customer token associations.
- CVV Retention Policy. If Company B needs CVV access, Company A must set a retention policy first.
- Send a Guest’s Card to a Hotel. Need to send the actual card data to a hotel instead of sharing the token?
- Process OTA and Channel Manager Payments. Receiving cards from a third party and need to charge them?
- Charge Multiple Hotels’ Gateways From One Account. Managing multiple hotels but staying on a single PCI Booking account? This may be a better fit than sharing across accounts.