Online Payments

Tokenization of payment data

Tokenization is the process of replacing sensitive payment data with a unique identification token that retains all the essential information without compromising security. This approach reduces the amount of sensitive data you must retain, significantly narrows your payment card industry compliance requirements, and lessens the potential impact of data breaches. J.P. Morgan supports the following types of tokens:

Network tokens

Network tokenization uses a token value assigned by a payment network. This allows you to use the existing token in the payment transactions without de-tokenizing it prior to payment processing. We use the same token in any subsequent actions related to the initial payment, including clearing, settlement, refunds, and dispute processing.

The networks secure the network tokens (NWTs) using a cryptogram and give a unique value prior to each transaction. The networks use this value to match the cryptogram generated for the authenticated token requester to the cryptogram for transaction processing. Because NWTs are issued by the payment network, they are compatible with any payment provider if you use the cryptogram and other required fields correctly.

Safetech tokens

The tokenization service converts the Primary Account Number (PAN) and bank account information to the acquirer tokens issued by us. Store these tokens safely in your system instead of the full PAN or bank account information.

Tokenization support

The following table lists the tokenization support by the method of payment:

Tokenization support by the method of payment
Method of payment (MOP)	Network token	Safetech token
Card	Yes	Yes
Bank account number for an Electronic Check Payment (ECP)	No	Yes
Card for a payment made with digital wallets such as Apple Pay, Google Pay, or Paze	No	Yes

Before you begin

Contact your relationship manager to enroll in the Tokenization service. This is an optional service offered by us to create and manage tokens.

How tokenization works

You send a POST request to the /intent endpoint (Set up checkout intent) with either of the following options:
1. authorizationType = AUTH_METHOD_VERIFY_ONLY: Use this to run account verification for cards and bank accounts. The tokenization service returns the token if you are set up for it.
2. authorizationType = AUTH_METHOD_TOKENIZE_ONLY: Use this to get the tokens for the cards or bank accounts without going through the account verification.
A new consumer is checking out and pays with one of the supported payment methods. The Checkout backend processes the transaction and the token and the associated information is returned to you in the Checkout token and order notifications. You send a GET request to the /notifications endpoint to retrieve the notifications. Refer to the following tables for the details.

Verify only authorization type

Refer to the following table for authorizationType = AUTH_METHOD_VERIFY_ONLY.

Refer to the following table for authorizationType = AUTH_METHOD_VERIFY_ONLY
MOP	Account verification	Token information returned in the checkout notification
Cards	Done	`tokenNotification` `token` contains the tokenized card number. `tokenType` contains the type of token returned (`TOKEN_TYPE_ACQUIRER` or `TOKEN_TYPE_NETWORK`).
ECP	Done	`tokenNotification` `token` contains the tokenized bank account. `tokenType` contains the type of token returned (only `TOKEN_TYPE_ACQUIRER` is supported).
Pay by Bank (PbB)	Done - Implicit as a result of PbB account linking.	`tokenNotification` `token` contains the payment instrument (bank account or transaction authentication number) tokenized by PbB. `tokenType` contains the type of token returned (only `TOKEN_TYPE_ACQUIRER` is supported).
Apple Pay	Done (Managed by the wallet provider. Additional account verification is not initiated by us for digital wallets.)	`tokenNotification` `token` contains the tokenized card number. `tokenType` contains the type of token returned (only `TOKEN_TYPE_ACQUIRER` is supported). `orderNotification` `electronicCommerceIndicator` contains the indicator value that is used in cardholder authentication on a network token. `tokenAuthenticationValue` contains the cryptogram or the authentication value received from the payment networks for network token transactions.
Google Pay	Done (Managed by the wallet provider. Additional account verification is not initiated by us for digital wallets.)	`tokenNotification` `token` contains the tokenized card number. `tokenType` contains the type of token returned (only `TOKEN_TYPE_ACQUIRER` is supported). Note: `electronicCommerceIndicator` and `tokenAuthenticationValue` are not available for Google Pay.
Paze	Done (Managed by the wallet provider. Additional account verification is not initiated by us for digital wallets.)	`tokenNotification` `token` contains the tokenized card number. `tokenType` contains the type of token returned (only `TOKEN_TYPE_ACQUIRER` is supported). `orderNotification` `electronicCommerceIndicator` contains the indicator value that is used in cardholder authentication on a network token. `tokenAuthenticationValue` contains the cryptogram or the authentication value received from the payment networks for network token transactions.

Tokenize only authorization type

Refer to the following table for authorizationType = AUTH_METHOD_TOKENIZE_ONLY.

Refer to the following table for authorizationType = AUTH_METHOD_TOKENIZE_ONLY
MOP	Token information returned in the token notification
Cards	`tokenNotification` `token` contains the tokenized card number. `tokenType` contains the type of token returned (`TOKEN_TYPE_ACQUIRER` or `TOKEN_TYPE_NETWORK`).
ECP	`tokenNotification` `token` contains the tokenized bank account. `tokenType` contains the type of token returned (only `TOKEN_TYPE_ACQUIRER` is supported).
PbB	`tokenNotification` `token` contains the payment instrument (bank account or transaction authentication number) tokenized by PbB. `tokenType` contains the type of token returned (only `TOKEN_TYPE_ACQUIRER` is supported).
Apple Pay	`tokenNotification` `token` contains the tokenized card number. `tokenType` contains the type of token returned (only `TOKEN_TYPE_ACQUIRER` is supported). `orderNotification` `electronicCommerceIndicator` contains the indicator value that is used in cardholder authentication on a network token. `tokenAuthenticationValue` contains the cryptogram or the authentication value received from the payment networks for network token transactions.
Google Pay	`tokenNotification` `token` contains the tokenized card number. `tokenType` contains the type of token returned (only `TOKEN_TYPE_ACQUIRER` is supported). Note: `electronicCommerceIndicator` and `tokenAuthenticationValue` are not available for Google Pay.
Paze	`tokenNotification` `token` contains the tokenized card number. `tokenType` contains the type of token returned (only `TOKEN_TYPE_ACQUIRER` is supported). `orderNotification` `electronicCommerceIndicator` contains the indicator value that is used in cardholder authentication on a network token. `tokenAuthenticationValue` contains the cryptogram or the authentication value received from the payment networks for network token transactions.

Tokenization samples

The following sections include sample request and response code corresponding to some of the previously described scenarios.

Verify intent request

Method: POST

Endpoint: /checkout/intent

Scenario: Sample verify intent request.

Json

{
  "merchantOrderNumber": "intent-1bssxn3",
  "currencyCode": "USD",
  "cart": {
    "totalTransactionAmount": 0
  },
  "checkoutOptions": {
    "authorization": {
      "authorizationType": "AUTH_METHOD_VERIFY_ONLY"
    },
    "capture": {
      "captureMethod": "CAPTURE_METHOD_MANUAL"
    }
  }
}

Tokenize intent request

Method: POST

Endpoint: /checkout/intent

Scenario: Sample tokenize intent request.

Json

{
  "merchantOrderNumber": "intent-1bssxn3",
  "currencyCode": "USD",
  "cart": {
    "totalTransactionAmount": 0
  },
  "checkoutOptions": {
    "authorization": {
      "authorizationType": "AUTH_METHOD_TOKENIZE_ONLY"
    },
    "capture": {
      "captureMethod": "CAPTURE_METHOD_MANUAL"
    }
  }
}