> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paypal.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# NFC Device Tokenization Overview

## Overview

You can use device tokenization to provision payment credentials onto Near Field Communication (NFC)-enabled devices so that cardholders can make secure tap-to-pay transactions at point-of-sale terminals.

NFC device tokenization works by replacing a cardholder's real payment credentials, such as a card number, with a tokenized primary account number (TPAN) issued by the network. This payment credential replaces the real card number and is safe to store on a device.

Device tokenization is offered as part of [**Secure Credential Services (SCS) by PayPal**](/limited-release/tokenization/secure-credential/scs/). Rather than building and maintaining separate integrations with each payment network, device partners integrate once with PayPal Token Service Provider (PP TSP). This single, certified path covers token provisioning, payment credential delivery, lifecycle management, and outbound webhook notifications across all supported networks. PP TSP handles sensitive card data on your behalf, significantly reducing your PCI DSS scope.

> **Note:** This page covers NFC device tokenization. It is distinct from PayPal's Ecommerce Network Tokenization (card-not-present) offering. Do not use this guide for online checkout integrations.

### Tokenization flow

NFC device tokenization involves five participants who interact from initial card enrollment, through everyday tap-to-pay use, and ongoing lifecycle management.

![Swimlane diagram showing the five participants, Cardholder, Device Partner/Wallet Server, PP TSP, Card networks, and Issuers, and how they interact across device registration, enrollment, tokenization, credential delivery, tap to pay, and lifecycle management.](https://www.paypalobjects.com/ppdevdocs/nfc/tokenization-flow-diagram.svg)

Each participant has a specific role in that process:

| Participant                    | Role                                                                                                                                                 |
| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
| Cardholder                     | Adds a card to their NFC-enabled device and initiates tap-to-pay transactions at point of sale.                                                      |
| Device Partner / Wallet Server | The device partner's backend. Calls PP TSP APIs to register devices, manage enrollments, fetch payment credentials, and handle lifecycle operations. |
| PP TSP                         | Provisions network tokens, stores and delivers payment credentials, manages token lifecycle, and publishes webhook events to Wallet Server.          |
| Card networks                  | Issue and manage network tokens and payment credentials. PP TSP mediates all interactions with the networks on your behalf.                          |
| Issuers                        | Approve tokenization requests and authorize NFC transactions at point of sale.                                                                       |

### How NFC device tokenization works end to end

NFC device tokenization happens in three stages: enrollment and activation, credential provisioning and tap to pay, and lifecycle management. Each stage is shown in its own diagram.

#### Device registration and token enrollment

The device partner registers the device and enrolls the cardholder's card, then the card network decides whether the token activates immediately or needs identity verification (IDV) first.

```mermaid theme={null}
sequenceDiagram
    autonumber
    actor Cardholder
    participant Wallet as Device Partner / Wallet Server
    participant TSP as PP TSP
    participant Network as Card Network
    participant Issuer as Issuer

    Wallet->>TSP: Register NFC device
    TSP-->>Wallet: device_id

    Cardholder->>Wallet: Authenticate & select card to add
    Wallet->>TSP: Create enrollment (encrypted card details)
    TSP->>Network: Check card eligibility
    TSP-->>Wallet: enrollment_id & T&C id

    Cardholder->>Wallet: Accept terms & conditions
    Wallet->>Network: Submit tokenization request (via TSP)

    alt Green path — no IDV required
        Network-->>TSP: Token → ACTIVE
    else Yellow path — IDV required
        Network-->>TSP: Token → PENDING_VERIFICATION_REQUIRED
        Issuer->>Cardholder: Request identity verification (IDV)
        Cardholder->>Issuer: Complete IDV
        Issuer-->>Network: IDV result
        Network-->>TSP: Token → ACTIVE
    end
```

1. The device partner registers the NFC device with PP TSP and receives a unique `device_id`.
2. The cardholder authenticates and selects a card to add to their PayPal wallet.
3. The Wallet Server creates an enrollment with PP TSP, including encrypted card details. PP TSP checks card eligibility with the card network and returns an enrollment ID and a terms and conditions (T\&C) ID.
4. The cardholder reviews and accepts the T\&C. The Wallet Server submits a tokenization request to the card network through PP TSP.
5. The card network determines the token activation path:
   * **Green path**: no IDV required. The token is provisioned and moves to `ACTIVE`.
   * **Yellow path:** IDV required. The token is held in `PENDING_VERIFICATION_REQUIRED` until the cardholder completes verification, after which it moves to `ACTIVE`. If IDV is not completed, the token remains in this state and cannot be used for transactions.

#### Credential provisioning and tap to pay

PP TSP provisions the payment credential for the Wallet Server to fetch, then the cardholder can tap to pay.

```mermaid theme={null}
sequenceDiagram
    autonumber
    actor Cardholder
    participant Wallet as Device Partner / Wallet Server
    participant TSP as PP TSP
    participant Network as Card Network
    participant Issuer as Issuer

    TSP-)Wallet: Webhook — PAYMENT-CREDENTIAL.CREATED
    Wallet->>TSP: Fetch credentials & acknowledge
    TSP->>Network: Confirm successful provisioning

    Cardholder->>Network: Tap device (one-time cryptogram)
    Network->>Issuer: Request authorization
    Network-->>TSP: Transaction result
    TSP-)Wallet: Webhook — TRANSACTION.CREATED
```

1. PP TSP provisions the TPAN, caches encrypted payment credentials, and notifies the Wallet Server using a `PAYMENT-CREDENTIAL.CREATED` webhook.
2. The Wallet Server fetches the payment credentials and acknowledges receipt. PP TSP notifies the card network that provisioning was successful.
3. The credential is ready for tap to pay. Each transaction generates a one-time cryptogram bound to the token and the specific transaction context. PP TSP sends a `TRANSACTION.CREATED` webhook after each tap.

#### Token lifecycle management

PP TSP manages the ongoing token lifecycle, keeping the token synchronized with the payment method and notifying the Wallet Server whenever the card issuer or network changes its status.

```mermaid theme={null}
sequenceDiagram
    autonumber
    participant Wallet as Device Partner / Wallet Server
    participant TSP as PP TSP
    participant Network as Card Network
    participant Issuer as Issuer

    Issuer->>Network: Trigger status change
    Network->>TSP: Propagate change
    TSP-)Wallet: Webhook — TOKEN-STATUS.CHANGED
    Note over Wallet: SUSPENDED = declined until reactivated · ACTIVE = reactivated · CLOSED = permanent, blocked
```

1. The card issuer sends the card network a status change for the payment method.
2. The card network sends the status change to the PP TSP.
3. PP TSP sends a `TOKEN-STATUS.CHANGED` webhook to the Wallet Server to update the token for that payment method.

PP TSP supports the following token state changes:

* **Suspension:** token moves to `SUSPENDED`. NFC transactions are declined until the token is reactivated.
* **Reactivation:** token returns to `ACTIVE`.
* **Permanent deactivation:** token moves to `CLOSED`. Tap to pay is blocked. This state cannot be reversed.

### Next steps

* [**Integration Guide**](/limited-release/tokenization/nfc/integration/): Step-by-step instructions for connecting to PP TSP, including authentication, endpoint configuration, and webhook setup.
* [**API Reference**](https://developer.paypal.com/api/limited-release/payment-tokenization/v1/registerdevice): Full specification for all PP TSP endpoints, request/response schemas, and error codes.
* [**Key Concepts**](/limited-release/tokenization/nfc/key-concepts/): Definitions for terms and abbreviations used throughout the NFC device tokenization documentation.

> **Note:** For questions about eligibility or onboarding, contact your PayPal Technical Account Manager.