> ## Documentation Index
> Fetch the complete documentation index at: https://waffo.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Tokenization

> Securely store payment credentials using Waffo Tokens to enable one-click checkout, recurring billing, and delayed charges without handling raw card numbers.

Tokenization technology enables merchants to store user payment information securely without handling raw card numbers. It replaces sensitive bank card data with a non-sensitive random string — the **Waffo Token**.

Waffo provides a standardized Tokenization solution. Merchants integrate with a unified Token interface to achieve **"One-Click Payment"** and **"Recurring Billing"** without managing complex card scheme rules or security encryption details.

## Core value

## Why choose Waffo Tokenization

Our Token is not just a simple storage credential. It integrates Waffo's Smart Payment Engine to continuously optimize your transaction performance.

### Smart optimization

Waffo employs multiple industry-leading optimization technologies at the infrastructure level. When you initiate a charge using a Waffo Token, the intelligent engine automatically selects the optimal ISO message format and routing strategy based on issuing bank preferences, transaction types, and risk characteristics.

### Account updater

Waffo is deeply integrated with major card scheme networks to support automated card lifecycle management.

## Use cases

## Lifecycle management flow

**1. Create Token**

* **User side:** The user checks "Save this card for future use" at checkout.
* **System side:** Waffo validates card data, performs multi-layer encryption, and returns a Token ID to the merchant.

**2. Verify & charge**

* **Verify:** Perform a Zero-Auth (0 amount) or \$1 pre-authorization at the time of binding to confirm the card is active and chargeable.
* **Charge:** When initiating a payment, your backend sends the Token ID directly — no card number required.

**3. Manage & display**

* Retrieve a list of all bound Tokens for a specific user via API.
* The API returns masked information (Card Brand, Last 4 Digits, Expiry Date, Card Art Background Color) for frontend display and user selection.

## Integration & migration

### Integration methods

### Data migration

Waffo supports flexible data migration schemes to eliminate vendor lock-in concerns.

[View API Documentation](/docs/api-reference/introduction)

## Frequently asked questions

> **Is saving credit cards secure?**
>
> Extremely secure. Waffo holds the highest level of security certification, PCI-DSS Level 1 (Financial Grade Security Standard). Actual card number data is encrypted and stored in physically isolated vaults. The merchant's system and database store only the meaningless Token string. Even if the merchant's database is compromised, hackers cannot reconstruct the real bank card information.

> **Does the Token expire?**
>
> The Waffo Token itself is permanently valid unless you proactively call the API to delete it. Even if the underlying physical card expires, thanks to our Account Updater feature, the system automatically maintains the mapping relationship in most cases without manual intervention from you or the user.

> **How do I verify that the bound card is valid?**
>
> We recommend performing a Zero Amount Verify at the same time the Token is created. This ensures that the card corresponding to the Token is real, valid, not reported lost, and capable of being charged at the moment of binding.

> **Can I share the Token with my sub-merchants?**
>
> This depends on your account architecture. If you are a Platform merchant, you can authorize payment credentials to sub-merchants via "Token Cloning" to achieve a unified wallet experience.

***

Need help? [Contact support](mailto:support@waffo.com)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.