> For the complete documentation index, see [llms.txt](https://docs.omni.integratedcommerce.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.omni.integratedcommerce.io/payments/tokenization.md).

# Tokenization

Store a card once and charge it from any channel.

The API implements a tokenization system that:

* Creates payment tokens from both Card Present and Card Not Present transactions
* Maintains tokens that work across all channels (in-person and online)
* Supports token creation and removal.

A token is a stored payment method with a `pmt_tkn_` identifier. It can hold a card or an ACH bank account: any payment method a customer provides can be tokenized. Once created, it is charged exactly like any other payment method - which is what makes a card captured on a terminal reusable for an online charge, and vice versa. An ACH token is limited to sales; see [ACH bank transfers](/payments/ach.md).

## Creating a token

| Source                                | Endpoint                         |
| ------------------------------------- | -------------------------------- |
| A card presented on a terminal        | `POST /payment-methods/physical` |
| A card or bank account entered online | `POST /payment-methods/virtual`  |

Physical tokenization performs a 1-cent authorization. Virtual tokenization creates a session with `requestedAmount: 0`.

The virtual endpoint returns a session you render with the [Hosted Payment Form](/hosted-payment-form/hosted-payment-form.md) or the [Payment SDK](/payment-sdk/payment-sdk.md); the token is created once the customer submits the form.

Sales and authorizations also produce a token as a side effect. The resulting token is in `transactionResponses[].paymentMethod.id`. The top-level `paymentMethod.id` identifies the terminal, form, or token used to start the request. The [redirect parameters](/hosted-payment-form/transaction-results.md) can also carry the resulting token.

## Charging a token

| Operation     | Endpoint                        |
| ------------- | ------------------------------- |
| Sale          | `POST /transactions/token-sale` |
| Authorization | `POST /transactions/token-auth` |

{% hint style="warning" %}
An ACH token can only be used for a token *sale*. Using one for an authorization is rejected with error code `2010` (`InvalidPaymentMethodType`). See [ACH bank transfers](/payments/ach.md#restrictions).
{% endhint %}

## Managing tokens

| Operation | Endpoint                             |
| --------- | ------------------------------------ |
| Remove    | `DELETE /payment-methods/token/{id}` |

## Handling an uncertain token sale

A token sale is the one flow where an unclear outcome is most expensive, because there is no customer in front of the form to tell you what happened. A token sale that returns `Interrupted` might still have charged the customer.

{% hint style="danger" %}
Never retry an `Interrupted` token sale directly. Resolve the outcome with [`GET /transactions`](/payments/transaction-retrieval.md) first.
{% endhint %}

## Related

* [Account holders](/payments/account-holders.md) - group a customer's tokens together
* [Token notifications](/webhooks/events.md#token-events) - `token.created` and `token.removed`