Network tokens vs gateway tokens: what is the difference?

A gateway token, also called a PCI, vault or acquiring token, is a reference created by your payment gateway or processor that points to a card number held in that provider's vault. It keeps the card number out of your systems but works only with that provider. A network token is issued by a card network's token service, such as Visa Token Service or Mastercard Digital Enablement Service (MDES), replaces the card number in the payment itself, and can be kept current by the issuer when the card is replaced. They solve different problems, which is why many card-on-file merchants use both.

What is a gateway token?

PCI SSC calls these acquiring tokens: they are created by the acquirer, the merchant or the merchant's service provider after the cardholder presents a card number, the solutions are proprietary, and they are used for card-on-file and recurring payments. PCI SSC: acquiring, issuer and payment tokens

Adyen's documentation is a typical example: Adyen swaps the shopper's card details for a token, returns it in a webhook, and you send that token in later recurring requests. Adyen: tokenization When you charge the token, the provider looks up the credential in its vault and sends it to the network. The issuer still sees the card number, or whatever credential the provider holds.

What is a network token?

PCI SSC defines payment tokens as tokens created by token service providers registered with EMVCo and used under EMVCo's technical framework; the cardholder presents the token in place of the card number, and the merchant and acquirer never receive the underlying PAN. PCI SSC: token types FAQ

Adyen describes a network token as a 16-digit alternative to the PAN created by networks such as Visa, Mastercard and American Express, unique to each shopper and merchant pair, that stays the same when the shopper receives a replacement card. Adyen: network tokenization EMVCo's guide adds token domain restriction controls, which limit a token to the requestor it was issued for. EMVCo: Payment Tokenisation use cases For the Visa side in detail, see what is Visa Token Service.

Network tokens vs gateway tokens: side-by-side comparison

Which one reduces PCI DSS scope?

Both can, for different systems. PCI SSC's tokenization guidance says the key to reducing scope is not storing, processing or transmitting cardholder data. It treats every part of the tokenization system, including detokenization and PAN storage, as in scope, and allows a system holding tokens to be out of scope only if it is segmented from the vault and cannot recover the PAN. PCI SSC: Tokenization Guidelines

A gateway token moves the vault to your provider. A network token removes the PAN from the payment message as well, but the page or SDK that first captures the card is still in scope either way. The SAQ you file depends on how card data reaches the provider; see PCI compliance with hosted checkout.

Do network tokens improve authorization rates?

Only the networks and providers publish figures, and they measure on their own data:

• Visa claims a 4.8% increase in authorization rates for tokenized card-not-present transactions compared with PAN, based on VisaNet data for 2025, and notes merchant results may vary. Visa: tokenization
• Stripe says that because network tokens are tied to the network, a payment can still succeed after the card number or expiry date changes. It adds that network tokens can reduce interchange costs for businesses on interchange-plus pricing and help avoid scheme fee penalties in some markets. Stripe: payments optimization
• Adyen recommends combining its own tokenization with network tokenization, saying this limits PCI scope and further increases authorization rates. Adyen: network tokenization

A gateway token has no authorization effect by itself. Providers often pair it with an account updater instead: Stripe describes its card account updater as working with the networks' updater services and notes it may charge a fee for each updated card. Stripe: import payment method data Network services carry their own fees too; Stripe notes that network fees such as Visa's Digital Credential Updater fee are not reflected in its savings figures. Stripe: Authorization Boost Measure the result on your own traffic with a holdout group before you build a business case on it.

Can you take your tokens with you when you change provider?

Gateway tokens stay with the provider. Moving means a provider-to-provider migration of the underlying card data, which providers such as Stripe document as a supported import process. Stripe: import payment data

Network tokens follow the token requestor. If your provider is the requestor, the tokens work through that provider; Adyen, for example, states that its managed network tokenization applies only to payments it acquires, not to external acquirer connections. Adyen also offers a mode where you manage network tokens yourself, which cannot be combined with its own tokenization. Adyen: network tokenization Before signing, ask who the requestor is and what happens to the tokens at exit.

Watch scheme product changes too. Mastercard's developer documentation says MDES for Merchants will be globally decommissioned on 31 December 2026, and existing customers must integrate with Secure Card on File and migrate their tokens before then. Mastercard Developers: MDES Digital Enablement API

When does a merchant need both?

Europe: Mastercard is pushing network tokens toward the default for e-commerce. Mastercard committed in June 2024 to 100% e-commerce tokenization in Europe by 2030 Mastercard: 2030 tokenization commitment, and a year later reported that nearly half of its European e-commerce transactions were tokenized, with Secure Card on File live in 45 European countries and territories. Mastercard: one year in Merchants selling into the UK, Germany and the wider EU should ask their provider for its network-token coverage by brand.

FAQ

Is a network token the same as a PCI token?

No. A PCI or gateway token is a provider's reference to a card stored in its vault. A network token is issued by the card network's token service and replaces the card number in the payment itself.

Are network tokens portable between payment gateways?

Only as far as the token requestor arrangement allows. Tokens requested by your gateway generally work through that gateway; ask how they are handled if you leave.

Do network tokens remove PCI DSS obligations?

No. They can reduce where card numbers exist, but the system that first captures the card and any component that can recover a PAN remain in scope.

Do gateway tokens improve authorization rates?

Not by themselves; the issuer still receives the stored card credential. Providers usually add an account updater service to keep stored cards current.

Who creates the network token for my merchant account?

Usually your gateway or acquirer acting as token requestor, or your business if it is registered as one. The network tokenization lifecycle guide covers what to record once tokens exist.