Definition
A network token is a substitute card credential with defined usage restrictions and lifecycle management.
A network token is a payment credential, not a merchant's arbitrary customer ID. Its permitted use can be bound to a merchant, device or other domain. See Adyen's implementation documentation for merchant/shopper scope, lifecycle management and forwarding conditions.
What changes for the operator?
- Credential lifecycle: eligible account changes can be reflected without asking the shopper to type the card again. Suspended, deleted or unsupported tokens still need handling; lifecycle management is not a guarantee against declines.
- Processor choice: support for Visa Token Service or Mastercard MDES alone does not establish that a particular token can be moved unchanged. Confirm the token-requestor relationship, cryptogram requirements, receiving processor and export/forwarding procedure.
- Authorization: better credential freshness and transaction information may help. Compare like-for-like outcomes; do not assume a universal percentage uplift or a frictionless authentication result.
- PCI scope: tokenization can reduce exposure, but scope depends on implementation. Authentication and chargeback liability require separate analysis.
A practical migration check
Hypothetical case: the checkout saves a provider vault ID, while the provider uses a network token behind it. The merchant's saved ID is still a provider reference; it is not necessarily the network credential itself. Before switching processors, establish which object can be exported, who can use it, how lifecycle updates continue and how unsupported cards will be handled.
| Ask the provider | Evidence to request |
|---|---|
| What credential do we actually store? | Vault-reference versus network-token data flow |
| Which destinations can use it? | Supported processor and network restrictions |
| What if a token cannot be used? | Documented fallback and consent/authorization requirements |
| How do we avoid duplicate charges during cutover? | Transaction identity and confirmed prior-attempt outcomes |
Tokenization compares the storage models. The orchestration reference explains why vault custody and routing are separate choices.