Tokenization

Tokenization is a process in which the system stores sensitive payment details remotely using a payment gateway processor. This reduces the security burden and limits the liability on you as a business.

Because only the remote payment gateway can access the stored payment details, only that gateway can use that pay method. This restricts the use of other payment gateways. For example, a customer would not be able to use a Stripe pay method on an Authorize.net invoice.

  • The system won’t add the token to WHMCS until someone has submitted a payment through the module. The system will store the credit card details in the database directly until the client makes a payment on an invoice through one of the token type gateway modules. After the payment is complete, the system fetches the token and replaces the credit card details in the database.
  • Storage of the credit card details can also happen when the client updates their credit card details or when they place an order and the system does not process the payment immediately.
  • If you use a mix of both tokenized and non-tokenized payment gateways, customers can choose the desired payment method when adding one via the Client Area. This determines whether to store the card locally encrypted in the WHMCS database or remotely with the tokenized payment gateway.

Tokenization Migration

If you have previously used a payment gateway that stores credit cards locally, you may wish to switch to a tokenized payment gateway solution. Activating a tokenization gateway in addition to a non-tokenized merchant gateway module will still allow admins and clients to store credit cards locally.

Activating a tokenization gateway does not remove existing locally stored credit cards from the database.

In many cases, WHMCS can automatically convert locally-stored credit cards to tokenized cards upon the next automated recurring payment attempt. However, this is not possible for some tokenized gateways due to technical restrictions from the gateways themselves. For more information, see your payment gateway’s documentation.

To enforce the use of a tokenization gateway for clients, see Enforcing Tokenization below.

Enforcing Tokenization

To enforce the use of a tokenization gateway and prevent local storage of new credit cards, hide all non-tokenization payment gateways from the order form.

To do this:

  1. Go to Configuration () > System Settings > Payment Gateways.
  2. In WHMCS 8.6 and earlier, select the Manage Existing Gateways tab.
  3. Deselect Show on Order Form for all non-tokenization payment gateways in the list.
  4. Click Save Changes.

This does not delete existing credit cards in the local database. To delete them, use Delete Encrypted Credit Card Data in the Security tab at Configuration () > System Settings > General Settings.

Remote Update Card

For gateways with the Remote Update Card feature, clients can enter their card details via the WHMCS Client Area. This is done via an interface that the payment gateway hosts directly or by paying an invoice. This creates a profile in the payment gateway’s system that returns a token.

WHMCS uses this to manage the card detail update requests via the Client Area and recurring payments. This does not store the full card details on your server, and some token gateways never touch it.

payment-gateways tokenization

Last modified: October 30, 2024