Skip to content
SPECIFICTION
Get listed

Worldpay eProtect

docs.worldpay.com

WebiOSAndroidAPI
Visit docs.worldpay.com
Spec score 7.1 #13 of 22 in Payment Tokenization Software

What it is

Worldpay eProtect handles card-not-present payments by replacing card details with a low-value Registration ID, which Worldpay can exchange for an OmniToken during authorization, a sale, or token registration. The cloud service is available through an iFrame, the JavaScript Customer Browser API, or a Mobile API, with platforms listed as Android, iOS, web, and API. Worldpay says card data does not pass through the merchant’s web server and that eProtect reduces applicable PCI controls. The iFrame hosts card number, expiration, and CVV2 fields in Worldpay’s PCI-compliant environment; JavaScript validates and encrypts the account number before sending it to Worldpay. The resulting token may support card-on-file payments, returns, and recurring billing. The guide covers Apple Pay, Apple Pay on the Web, Google Pay, and Visa Checkout. Before production use, an organization must be enabled and certified to process OmniTokens, obtain a PayPage ID, and complete certification testing. The token exchange does not check CVV or AVS and does not validate expiration dates. Pricing is on request.

Spec sheet

Purpose
eProtect is designed for card-not-present payments and reduces the amount of payment data in a merchant’s systems.Read 7 Oct 2026 · docs.worldpay.com
Support
The guide lists 24/7 technical support for critical production issues and says technical support representatives respond to eCommerce technical issues within 15 minutes.Read 7 Oct 2026 · docs.worldpay.com
Accessibility
The guide says iFrame version 4 improves screen-reader accessibility for expiration fields and error messages; version 3 lacks those upgrades.Read 7 Oct 2026 · docs.worldpay.com
Availability
Worldpay says primary and secondary endpoint routing supports high availability for eProtect JavaScript API version 3 or higher.Read 7 Oct 2026 · docs.worldpay.com
Card data handling
The guide states that card data is not transmitted through the merchant web server and that the token server stores the card number but not CVV or expiration date.Read 7 Oct 2026 · docs.worldpay.com
Certification
The guide says successful eProtect certification testing is required before production use.Read 7 Oct 2026 · docs.worldpay.com
Checkout features
The iFrame offers real-time inline field validation, configurable payment-form behaviors, and account-number auto-formatting based on card type.Read 7 Oct 2026 · docs.worldpay.com
Company headquarters
Worldpay states that it is headquartered in Cincinnati, Ohio, United States.Read 7 Oct 2026 · privacy.worldpay.com
Follow-on payments
The guide says an OmniToken may be used for card-on-file transactions, returns, and recurring billing.Read 7 Oct 2026 · docs.worldpay.com
Hosted card fields
With the iFrame API, payment card fields are hosted from Worldpay’s PCI-compliance environment instead of being embedded in the merchant checkout page.Read 7 Oct 2026 · docs.worldpay.com
iFrame fields
The iFrame API hosts sensitive payment fields, including card number, expiration date, and CVV2, in Worldpay’s PCI-compliant environment.Read 7 Oct 2026 · docs.worldpay.com
Integration methods
The guide describes iFrame API, JavaScript Customer Browser API, and Mobile API integrations.Read 7 Oct 2026 · docs.worldpay.com
Integration options
The guide describes iFrame, JavaScript Customer Browser API, and Mobile API integration options.Read 7 Oct 2026 · docs.worldpay.com
JavaScript handling
The JavaScript API validates and encrypts the account number before sending it to Worldpay and returns a Registration ID in its place.Read 7 Oct 2026 · docs.worldpay.com
Onboarding requirement
Before using eProtect, an organization must be enabled and certified to process OmniTokens and obtain a PayPage ID from its eProtect Implementation Consultant.Read 7 Oct 2026 · docs.worldpay.com
Payment methods
The guide includes integration instructions for Apple Pay on the Web, Google Pay, and Visa Checkout.Read 7 Oct 2026 · docs.worldpay.com
Payment types
The eProtect PCI Non-Sensitive feature can tokenize private-label and Worldpay gift cards, subject to the Worldpay message interface specification.Read 7 Oct 2026 · docs.worldpay.com
Prerequisites
Before using eProtect, an organization must be enabled and certified to process OmniTokens and obtain a PayPage ID from its eProtect Implementation Consultant.Read 7 Oct 2026 · docs.worldpay.com
Security and PCI
Worldpay says no card data is transmitted through the merchant’s web server and that eProtect reduces applicable PCI controls.Read 7 Oct 2026 · docs.worldpay.com
Token flow
eProtect returns a low-value Registration ID, which Worldpay can exchange for an OmniToken during authorization, sale, or token registration.Read 7 Oct 2026 · docs.worldpay.com
Token use
The guide says the resulting OmniToken can be used for follow-on transactions such as card-on-file, returns, and recurring billing.Read 7 Oct 2026 · docs.worldpay.com
Tokenization
It exchanges card details for a low-value Registration ID, which is exchanged for a Worldpay token during a transaction.Read 7 Oct 2026 · docs.worldpay.com
Validation limit
The guide states that eProtect’s token exchange does not check CVV or AVS information and does not validate expiration dates.Read 7 Oct 2026 · docs.worldpay.com
Wallets
The guide includes eProtect support sections for Apple Pay, Apple Pay on the Web, Google Pay, and Visa Checkout.Read 7 Oct 2026 · docs.worldpay.com

Strong points and limits

Strong points

  • Offers iFrame, JavaScript, and Mobile API integrations.
  • Card data does not pass through the merchant web server.
  • OmniTokens can support recurring billing and returns.
  • Lists several digital wallet integrations.
  • Critical production issues have 24/7 technical support.

Limits

  • Pricing is on request.
  • Production requires enablement and certification testing.
  • Token exchange does not validate CVV, AVS, or expiration.

Who it suits

eProtect suits merchants processing card-not-present payments who want to reduce card data passing through their systems. It also fits organizations able to complete the OmniToken enablement and certification requirements.

Verdict

eProtect provides several integration paths and a token flow for follow-on transactions. Merchants should account for onboarding requirements and the stated limits on payment-data validation.

Where Specifiction places it

Alternatives to Worldpay eProtectAll alternatives →