What are gateway/PSP tokens?
Summary: This article explains what gateway or PSP tokens are and how card tokenisation helps secure online card payments. It outlines the benefits and limitations of gateway-issued tokens and introduces a more flexible, PSP-agnostic approach that enables merchants to scale, optimise routing, and retain control of stored card data.
For fast, reliable payments, cards remain the most popular payment method for South African consumers. But fraud is a real issue. In 2024, total card fraud losses increased by 26% to R1.46 billion. As a result, card tokenisation has become a key part of processing secure online card payments.
Definition: card tokenisation
To make payments easier and faster for repeat customers, merchants choose to let their customers save their card details on their site for later use. But instead of storing the actual card details, which is risky, a payment gateway or card network replaces it with a random identifier called a token.
A token seldom looks like real card data. It contains no sensitive information, so it’s useless outside the environment that created it.
What is gateway tokenisation?
Gateway tokens are created and managed by a payment gateway provider or payment service provider (PSP). They are stored in the provider's vault and can only be used within that provider’s ecosystem.
Benefits of gateway tokens
Gateway tokens offer merchants a quick way to store card details without any of the heavy lifting:
- Reduced PCI burden: Since no card data touches the merchant’s systems, the gateway handles PCI compliance.
- Fast implementation: Tokens are ready-made — no need to build in-house vaulting or infrastructure.
Downsides of gateway tokens
The trade-off is that gateway-issued tokens limit control and flexibility over how they are managed:
- Vendor lock-in: Tokens cannot be used outside the provider’s system. You lose them if you move to another PSP, or your PSP might charge you to import your tokens to a different PSP.
- Limited routing and orchestration: If token performance impacts your approval rates, you can't reroute transactions through a different gateway.
- Scaling constraints: As you expand to new markets or add new acquirers, tokens can't be shared across providers.
In short, gateway tokens are effective for single-provider setups, but they don’t hold up well when you want to scale, orchestrate, or take control of your payments.
Take control of tokens with Stitch Vault
Stitch Vault gives you the benefits of gateway-issued tokens without being locked in – you own the underlying PAN data in a dedicated vault.
Through a single PCI Level 1 certified vault, Stitch issues PSP-agnostic tokens. Continue using your existing providers, add new ones, or optimise routing without losing access to stored cards.
Stitch Vault features:
- Securely stores credentials
- Supports multi-PSP routing and orchestration
- Enables multiple payment flows using existing integrations
- PCI DSS Level 1 certified
- Built for portability, performance and control
FAQs
What is card tokenisation?
Card tokenisation replaces a customer’s card number with a random, non-sensitive identifier called a token, reducing the risk of fraud and exposure of card data.
What are gateway or PSP tokens?
Gateway or PSP tokens are tokens created and stored by a payment gateway or payment service provider. They can only be used within that provider’s ecosystem.
Why do merchants use gateway tokens?
Merchants use gateway tokens to securely store card details for repeat payments without handling sensitive card data themselves, reducing PCI compliance complexity.
What are the benefits of gateway tokenisation?
Benefits include reduced PCI burden, faster implementation, and simplified security, as the gateway manages card data and compliance.
What are the downsides of gateway tokens?
Gateway tokens can create vendor lock-in, limit routing and orchestration options, and restrict scalability when adding new PSPs or expanding into new markets.
Why is vendor lock-in a risk with gateway tokens?
Because gateway-issued tokens cannot be used outside the provider’s system, merchants may lose access to stored cards if they change PSPs or face costly token migration fees.
How does PSP-agnostic tokenisation improve flexibility?
PSP-agnostic tokenisation allows merchants to use stored cards across multiple providers, optimise routing, and scale without losing access to customer payment credentials.
What is Stitch Vault?
Stitch Vault is a PCI DSS Level 1 certified token vault that issues PSP-agnostic tokens, giving merchants secure storage, portability, and full control over their tokenised card data.
Build scalable, tokenised payment experiences
