American Express Token Service vs Worldpay eProtect

American Express Token Service replaces a card’s primary account number with a payment token for online and mobile commerce. It includes a token vault, token issuance and provisioning, lifecycle management, and risk management. Tokens are surrogate values that can be restricted by retailer, number of uses, lifetime, and other variables, and follow EMVCo Payment Tokenization specifications. During provisioning, issuers can assess whether a card is active, suspected of fraud, eligible for tokenization, and belongs to the card member requesting the token. Lifecycle management can keep tokens current when cards are replaced, reducing manual updates to stored payment details. Listed uses include card-on-file payments, Click to Pay, digital wallets, virtual cards, browser autofill virtual card numbers, and digital or numberless cards. The service is cloud-based and supports payment cards, card-on-file credentials, digital wallets, wearables, Click to Pay, and QR code payments. Pricing is on request; the listed plan is free, with no deployment or use fees stated. Availability varies by market and enablement is required.

Worldpay eProtect handles card-not-present payments by replacing card details with a low-value Registration ID, which Worldpay can exchange for an OmniToken during authorization, a sale, or token registration. The cloud service is available through an iFrame, the JavaScript Customer Browser API, or a Mobile API, with platforms listed as Android, iOS, web, and API. Worldpay says card data does not pass through the merchant’s web server and that eProtect reduces applicable PCI controls. The iFrame hosts card number, expiration, and CVV2 fields in Worldpay’s PCI-compliant environment; JavaScript validates and encrypts the account number before sending it to Worldpay. The resulting token may support card-on-file payments, returns, and recurring billing. The guide covers Apple Pay, Apple Pay on the Web, Google Pay, and Visa Checkout. Before production use, an organization must be enabled and certified to process OmniTokens, obtain a PayPage ID, and complete certification testing. The token exchange does not check CVV or AVS and does not validate expiration dates. Pricing is on request.