Network tokenization
Network tokenization replaces the card number with a token from the card network that applies only to a specific merchant, device or agent and requires its own cryptogram for every payment.
Card networks such as Visa and Mastercard run their own token services. Instead of the real card number, a merchant or an agent receives a token bound to a domain, such as a merchant or an app. A one-time cryptogram is created for every payment. If a token falls into the wrong hands, it cannot be used outside its domain and can be blocked selectively without replacing the card.
For agentic commerce, tokenization is an important foundation: an agent can pay without knowing its customer's card details, and the network can bind tokens to the agent and its limits.
Example
A customer connects her card to her shopping agent. The card network issues a token valid only for this agent. The agent pays a merchant with it; the merchant never sees the real card number, and the customer can block the token at any time.
How it differs
Tokenization protects payment details but does not prove whether a purchase was within the intended limits. That is what signed purchase intents such as Verifiable Intent or a mandate are for. The Agentic Commerce Protocol describes how a token is handed over at checkout.
In practice
- Give agents tokens instead of card numbers, bound to the agent and, where possible, to limits.
- Block tokens selectively if an agent is compromised, instead of replacing the card.
- Record the limits of the purchase as evidence alongside the payment.
Role in KYA
KYA does not verify payment tokens. It verifies the evidence recording what the customer allowed, and whether the purchase for which a token was used stayed within those limits.
A term from the flow, not a check of its own. To the method
Frequently asked questions
What is network tokenization?
Replacing the card number with a token from the card network that applies only in a specific domain and requires a one-time cryptogram for every payment.
Why does tokenization matter for AI agents?
Because agents can pay without knowing the real card details. A token can be bound to the agent and blocked when needed.
Does a token prove that a purchase was allowed?
No. A token protects payment details. Whether the purchase was within the intended limits is shown only by evidence such as a signed purchase intent or a mandate.
Who issues network tokens?
The card networks' token services, such as the Visa Token Service or Mastercard MDES, usually through payment service providers and banks.