Tokenize Once, Fetch a Cryptogram Every Time
Provisioning a token and generating a cryptogram are separate calls, and you can’t get both in one response. You tokenize a card once with /tokenize, then call /transact only when you’re about to run a customer-initiated transaction (CIT). For merchant-initiated transactions (MIT), like subscription renewals, a cryptogram is not required. Instead, every MIT that uses a network token must reference an initial CIT that was authorized with a cryptogram. Make sure the first transaction on a stored token is a CIT with a cryptogram, then reference it in each subsequent MIT.Treat Every Cryptogram as Single-Use
Cryptograms don’t have a published expiration date, and each network handles them differently. For example, Mastercard accepts a cryptogram for up to five days, while Visa’s window is approximately 24 hours. As a best practice, don’t build around either window. For each customer-initiated transaction (CIT), fetch a fresh cryptogram right before you send the authorization. For recurring merchant-initiated transactions (MITs), you can skip the cryptogram and authorize with the token alone.TRID Tips
When Pagos registers your business for network tokenization, each card brand issues you a unique token requestor ID (TRID). A TRID identifies who is requesting a network token and ties every token you provision to your business. Keep in mind the following regarding your TRIDs:- You don’t need to pass your TRIDs in calls to the Pagos Network Tokenization API. We map your TRIDs to the x-merchant-id you pass in your API headers.
- If you need your Mastercard processing TRID for any reason (e.g. reconciliation with your processor), contact your Pagos Account Manager, and we’ll request it from Mastercard.
- Should you need to use the same tokens across affiliated businesses, contact your Pagos Account Manager for assistance; both Visa and Mastercard need to approve a shared TRID setup.