What is the difference between a vault token and a network token?
A vault token is created by a PSP, gateway or merchant vault and only has meaning inside that system; the card number still travels to the acquirer and scheme. A network token is issued by the card scheme with the issuer’s approval, replaces the card number across the whole chain and is updated when the card is reissued.
In detail
A vault token and a network token both replace a card number, but they work at different levels of the payment chain.
Vault token
A vault token is created by a PSP, a gateway or a merchant’s own vault. It protects card data at rest. At payment time, the vault swaps the token back for the PAN, and the card number is sent to the acquirer and the scheme as usual. The token is only meaningful to the provider that created it.
Network token
A network token is issued by the card scheme’s token service provider, after approval by the issuer. It is bound to a token requestor, and each payment carries a one-time cryptogram. The PAN is not exposed to the merchant, the PSP or the acquirer.
Key differences
- Lifecycle: network tokens are updated when a card is reissued, vault tokens are not.
- Approval rates: issuers tend to approve network token payments more often.
- Portability: vault tokens stay with their provider; network tokens follow the token requestor.
More in What Is Tokenization? and on the network tokenization page.