Built to keep card data secure

More than a token vault. Tokeni tokenizes, encrypts, and isolates your payment card data in a PCI DSS Level 1 certified environment. Your systems never touch raw card numbers.

Get a demo Read the docs

Isometric card tokenization illustration showing a payment card with the Tokeni vault chip

Your vault for sensitive card data

An isolated payment vault that slides into any payment stack without disrupting your business. Tokenize card data to make it secure and usable while staying compliant.

Replace raw PANs with non-reversible tokens
Reduce your PCI scope to SAQ A with hosted fields
HMAC-SHA512 signature verification on every detokenization
Full audit trail with tamper-proof logging

Isometric illustration showing application layer connected to secure vault via PrivateLink

Three API calls

Tokenize, detokenize, and validate. The vault handles encryption, storage, and PCI scope so your backend stays out of the cardholder data environment.

Tokenization flow: card data enters the tokenization engine, a secure token comes out

Tokenize

POST card data to the vault. Receive a non-reversible token. The PAN is encrypted with AES-256-GCM and stored inside the CDE. Your servers never persist raw card numbers.

Use the token

Store the token in your database. Pass it to payment processors, reconciliation systems, or customer profiles. The token is safe to log, index, and transmit.

Detokenize

When you need the original PAN for a processor or a refund, call detokenize with HMAC-SHA512 signature verification. Access is audited and rate-limited.

Built for developers

RESTful API with HMAC-SHA512 signature verification. Tokenize a card in one POST. Get back a token you can store anywhere.

Hosted Fields

Drop-in iframe captures card data directly from the browser. Your servers never see the PAN. Reduces PCI scope to SAQ A.

Server-to-server

Direct API integration for processors and payment orchestrators that already handle card data in their own CDE.

Webhooks

Event notifications for token lifecycle changes, expiration warnings, and detokenization access alerts.

# Tokenize a card
curl https://api.tokeni.io/api/v1/tokenize \
  -H "Authorization: Basic $API_KEY" \
  -H "Content-Type: application/json" \
  -H "Date: $(date -u +%a,\ %d\ %b\ %Y\ %T\ GMT)" \
  -d '{
    "pan": "4111111111111111",
    "expiryMonth": "12",
    "expiryYear": "2028"
  }'

# Response
{
  "tokenId": "tok_a1b2c3d4e5f6",
  "maskedPan": "411111******1111",
  "expiryMonth": "12",
  "expiryYear": "2028"
}

Isolated by design

The cardholder data environment runs in a dedicated AWS account with its own VPC, encryption keys, and network controls. No shared infrastructure with your application workloads.

Separate AWS accounts for CDE and application tier
Aurora PostgreSQL with envelope encryption and pgaudit
Network ACLs restrict data-tier subnets to vault traffic only
AWS PrivateLink for cross-boundary communication
GuardDuty and CloudTrail with tamper-proof log retention
WAF with rate limiting and managed rule sets

Architecture diagram showing isolated CDE vault connected to application layer via PrivateLink