Tokenization

Tokenization replaces PAN with non-reversible tokens. Payment tokens (Visa VTS, MC MDES) are domain-specific and can be updated when card reissued. Vault tokens are merchant-scoped. Tokens enable recurring billing without storing PAN.

// Token vault API
public interface TokenVault {
  String tokenize(RawCardData card);  // Returns tok_abc123
  DetokenizeResult detokenize(String token); // HSM-only, audited
  void deleteToken(String token);
}

// Network token (Visa VTS)
NetworkToken netToken = vts.provision(
  pan, expMonth, expYear, merchantId);
// netToken survives card reissue (automatic update)

// Usage in payment
PaymentRequest req = PaymentRequest.builder()
  .cardToken("tok_visa_4242_xyz")  // Never PAN
  .amount(Money.of(99.99, "USD"))
  .build();