Working with Tokenization - Revision history

SarahK: /* Enforcing Tokenization */

2024-04-23T17:36:17Z

‎Enforcing Tokenization

JuanR: /* Enforcing Tokenization */

2024-04-14T12:16:03Z

‎Enforcing Tokenization

SarahK at 19:55, 11 May 2022

2022-05-11T19:55:53Z

SarahK: Created page with "Tokenization is a process in which sensitive payment details are stored remotely by a payment gateway processor. This is intended to reduce the security burden and limit the l..."

2022-01-25T21:57:55Z

Created page with "Tokenization is a process in which sensitive payment details are stored remotely by a payment gateway processor. This is intended to reduce the security burden and limit the l..."

New page

Tokenization is a process in which sensitive payment details are stored remotely by a payment gateway processor. This is intended to reduce the security burden and limit the liability on you as a business. Examples of payment gateways that support tokenization include Authorize.net, Stripe, Quantum Gateway, etc...

When a tokenization payment gateway is in use, the details for a Pay Method are stored remotely by a given payment gateway and therefore the Pay Method is restricted for use only by the given payment gateway.

In such scenarios, the ability to use a given Pay Method with other payment gateways will be restricted. This will become apparent during checkout when switching between payment methods (also referred to as payment gateways) and the list of available Pay Methods changing. For example, a Stripe Pay Method cannot be used to pay an invoice assigned to Authorize.net and vice-versa.

===Tokenization Migration===

If you have previously used a Payment Gateway that stores credit cards locally and wish to switch to a Tokenized Payment Gateway solution, the following considerations apply:

# Activating a Tokenization Payment Gateway module in addition to a non-tokenized Merchant Gateway module will still allow credit cards to be stored locally by both Admin and Client Users.
# Activating a Tokenization Payment Gateway does not remove existing locally stored credit cards from the database. To do this, please refer to the ''Related Settings'' above.
# To enforce use of a tokenization Payment Gateway for Clients, please see the ''Enforcing Tokenization'' section below.
# In many cases, WHMCS can convert locally stored credit cards to tokenized cards upon the next automated recurring payment attempt automatically. With some tokenized Payment Gateways this may not be possible due to technical restrictions imposed by the Payment Gateway. Please refer to the documentation for your specific [[Payment Gateways|Payment Gateway]] for further information.

===Enforcing Tokenization===

To enforce the use of a Tokenization Payment Gateway and prevent new credit cards from being stored locally, you simply need to hide all non-tokenization Payment Gateways from the order form.

To do this, navigate to '''Configuration (<i class="fa fa-wrench" aria-hidden="true"></i>) > System Settings > Payment Gateways''' or, prior to WHMCS 8.0, '''Setup > Payments > Payment Gateways'''. Then, select the ''Manage Existing Gateways'' tab, and ensure the '''Show on Order Form''' checkbox is deselected for all non-tokenization Merchant Gateway Modules.

<div class="docs-alert-info">Note that doing this does not delete existing credit cards stored locally in the database. If you wish to do this, an option is available in '''Configuration (<i class="fa fa-wrench" aria-hidden="true"></i>) > System Settings > General Settings > Security''' or, prior to WHMCS 8.0, '''General Settings > Security'''. Please refer to the ''Related Settings'' for more information.</div>

@@ Line 20: / Line 20: @@
 To do this, go to the appropriate location for your version of WHMCS:
 * For WHMCS 8.6 and later, go to '''Configuration (<i class="fa fa-wrench" aria-hidden="true"></i>) > System Settings > [[Payment Gateways]]'''.
-* For WHMCS 8.0 and later, go to '''Configuration (<i class="fa fa-wrench" aria-hidden="true"></i>) > System Settings > [[Payment Gateways]]''' and choose '''Manage Existing Gateways'''.
+* For WHMCS 8.0 through WHMCS 8.5, go to '''Configuration (<i class="fa fa-wrench" aria-hidden="true"></i>) > System Settings > [[Payment Gateways]]''' and choose '''Manage Existing Gateways'''.
 * For WHMCS 7.10 and earlier, go to '''Setup > Products/Services > [[Payment Gateways]]''' and choose '''Manage Existing Gateways'''.
 Then, ensure the '''Show on Order Form''' checkbox is deselected for all non-tokenization Merchant Gateway Modules.
 <div class="docs-alert-info">Note that doing this does not delete existing credit cards stored locally in the database. If you wish to do this, an option is available in the '''[[Security Tab|Security]]''' tab at '''Configuration (<i class="fa fa-wrench" aria-hidden="true"></i>) > System Settings > General Settings''' or, prior to WHMCS 8.0, '''Setup > General Settings'''. Please refer to the ''Related Settings'' for more information.</div>

@@ Line 18: / Line 18: @@
 To enforce the use of a Tokenization Payment Gateway and prevent new credit cards from being stored locally, you simply need to hide all non-tokenization Payment Gateways from the order form.
-To do this, navigate to '''Configuration (<i class="fa fa-wrench" aria-hidden="true"></i>) > System Settings > [[Payment Gateways]]''' or, prior to WHMCS 8.0, '''Setup > Payments > Payment Gateways'''. Then, select the ''Manage Existing Gateways'' tab, and ensure the '''Show on Order Form''' checkbox is deselected for all non-tokenization Merchant Gateway Modules.
+To do this, go to the appropriate location for your version of WHMCS:
 <div class="docs-alert-info">Note that doing this does not delete existing credit cards stored locally in the database. If you wish to do this, an option is available in the '''[[Security Tab|Security]]''' tab at '''Configuration (<i class="fa fa-wrench" aria-hidden="true"></i>) > System Settings > General Settings''' or, prior to WHMCS 8.0, '''Setup > General Settings'''. Please refer to the ''Related Settings'' for more information.</div>