---
title: "Network tokens for digital wallets"
description: "Learn the process of creating a network token for a digital wallet."
url: "https://docs.adyen.com/issuing/tokens-digital-wallet"
source_url: "https://docs.adyen.com/issuing/tokens-digital-wallet.md"
canonical: "https://docs.adyen.com/issuing/tokens-digital-wallet"
last_modified: "2026-06-01T15:33:15+02:00"
language: "en"
---

# Network tokens for digital wallets

Learn the process of creating a network token for a digital wallet.

[View source](/issuing/tokens-digital-wallet.md)

Digital wallets are applications, such as Apple Pay and Google Pay, that allow cardholders to securely store card data and payment information. When your cardholder adds their Adyen-issued card to a digital wallet, they can make payments using the digital wallet, without presenting their physical card or entering their card details online.

Instead of storing your cardholder's sensitive card details, digital wallets make a network token request to Adyen. Upon this request, Adyen creates a network token that represents your cardholder's data and sends it to the digital wallet.

When your cardholder makes a payment, the digital wallet provides the network token data, instead of your cardholder's data. This process makes payments more secure and convenient for your cardholder.

## Requirements

Before you begin, make sure that you fulfill the following requirements:

| Requirement          | Description                                                                                                                                                                                                                                                                                                                                      |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Integration type** | You must have an integration that supports Issuing.                                                                                                                                                                                                                                                                                              |
| **API credentials**  | You need an API credential for the Configuration API that has the following role:- **Gives the user permissions to read and patch the NetworkTokens that are linked to the accounts they are able to access**                                                                                                                                    |
| **Webhooks**         | In your Customer Area, subscribe to [Network token webhooks](/development-resources/webhooks/webhook-types#network-token-webhook). Network token events are part of the Configuration API. For details on the webhook messages you receive during provisioning, see [Webhooks for network tokens](/issuing/webhook-types/network-tokens-events). |
| **Setup steps**      | Reach out to your Adyen contact to:- Make sure that you have set up a card manufacturing profile.
- (Optional) Enable [phone call authentication](#decision-process-for-provisioning).                                                                                                                                                           |

## Overview

To use a digital wallet, your cardholder must add the card to the digital wallet. When your cardholder attempts this, it triggers the following process:

1. Your cardholder tries to add their card to their digital wallet.
2. The digital wallet sends a network token request to the card scheme.
3. The card scheme sends the network token request to Adyen.
4. Adyen analyzes and approves the request if all the information in the request is correct.
5. Adyen sends the network token and the corresponding card details to the card scheme.
6. The card scheme stores the network token and the corresponding card details.
7. The card scheme sends the network token to the digital wallet.
8. The digital wallet stores the network token.

The following diagram shows the process for creating and activating a network token for a digital wallet.

[![](/user/pages/docs/07.issuing/18.tokens-digital-wallet/digital-wallets-flow.svg)](/user/pages/docs/07.issuing/18.tokens-digital-wallet/digital-wallets-flow.svg)

After the previous process is complete, your cardholder can use the digital wallet to make online or in-person payments.

When your cardholder makes a payment, your cardholder's payment data is processed as follows:

1. Your cardholder selects the digital wallet as a payment method.
2. The merchant sends the network token from the digital wallet to the card scheme.
3. The card scheme sends a request to Adyen to validate the status of the network token.
4. Adyen validates the status of the network token.
5. Adyen sends the result of the validation to the card scheme.
6. If the network token is valid, the card scheme approves the transaction.
7. The card scheme sends the approval to the merchant.

The following diagram shows the payment flow using a digital wallet.

[![](/user/pages/docs/07.issuing/18.tokens-digital-wallet/digital-wallets-payment.svg)](/user/pages/docs/07.issuing/18.tokens-digital-wallet/digital-wallets-payment.svg)

## Provisioning for a digital wallet

Provisioning is the process of creating a network token. Provisioning is initiated when your cardholder tries to add their card to a digital wallet.

The initial part of the provisioning flow is as follows:

1. Your cardholder adds the card to a digital wallet.
2. The digital wallet sends a request to the card scheme to create a network token for the card.
3. The card scheme forwards the network token request to Adyen.

After receiving the request, Adyen creates a network token with status **inactive**. Adyen then performs a risk analysis using the information provided in the network token request. Based on the outcome of the risk analysis, Adyen decides whether to activate the network token.

### Decision process for provisioning

The decision process has one of the following outcomes:

* Adyen activates the network token automatically, without further verifications.
* Adyen requires two-factor authentication to verify your cardholder's identity.
* Adyen requires that your cardholder contacts you by phone call to verify their identity.
* Adyen closes the network token automatically and ends the process.

The outcome of the decision process affects the flow provisioning process. The following tabs explain the flow of the provisioning process depending on the outcome of the decision process.

### Tab: Token activated automatically

Adyen activates the token automatically when the risk analysis determines that there is low risk associated with creating the network token. In this case, Adyen activates the network token without further verifications or additional API requests from your server.

When Adyen activates the network token automatically, the provisioning flow is as follows:

1. The provisioning process is initiated.
2. Adyen creates the network token with an **inactive** status.
3. Adyen sends a webhook to inform your server that a network token was created.
4. Adyen performs a risk analysis using the information in the network token request.
5. If the risk is low, Adyen changes the status of the network token to **active**.
6. Adyen sends a webhook to inform you about the decision.
7. Adyen sends the network token and the card details to the card scheme.
8. The card scheme stores the network token and the card details.
9. The card scheme sends the network token to the digital wallet.
10. The digital wallet stores the network token.

The following diagram shows the provisioning flow:

[![](/user/pages/docs/07.issuing/18.tokens-digital-wallet/token-activated-automatically.svg)](/user/pages/docs/07.issuing/18.tokens-digital-wallet/token-activated-automatically.svg)

### Tab: Two-factor authentication required

Adyen requires two-factor authentication (2FA) when the risk analysis determines that there is moderate risk associated with creating the network token. This can happen when, for example, your cardholder entered their card details manually on a digital wallet. In these cases, Adyen requires your cardholder to verify their identity by completing a 2FA challenge.

Adyen can only initiate 2FA if your cardholder has provided Adyen with an email or a phone number. If Adyen has this information, the provisioning flow with 2FA is as follows:

1. The provisioning process is initiated.
2. Adyen creates the network token with an **inactive** status.
3. Adyen sends a webhook to inform your server that a network token was created.
4. Adyen performs a risk analysis using the information in the network token request.
5. Adyen sends a two-factor authentication challenge to the cardholder.
6. If the cardholder successfully completes the challenge, Adyen changes the status of the network token to **active**.
7. Adyen sends a webhook to inform you about the decision.
8. Adyen sends the network token and the card details to the card scheme.
9. The card scheme stores the network token and the card details.
10. The card scheme sends the network token to the digital wallet.
11. The digital wallet stores the network token.

The following diagram shows the provisioning flow with 2FA:

[![](/user/pages/docs/07.issuing/18.tokens-digital-wallet/2fa-required.svg)](/user/pages/docs/07.issuing/18.tokens-digital-wallet/2fa-required.svg)

### Tab: Phone call authentication required

To enable phone call authentication, reach out to your Adyen contact.

Digital wallet providers require phone call authentication when the risk analysis determines that there is high risk associated with creating the network token. This can happen when, for example:

* Your cardholder's device has a high risk score.
* Your cardholder's account on the digital wallet has a high risk score.
* Your cardholder has not provided Adyen with an email or a phone number for two-factor authentication.

In these cases, your cardholder must contact your call center so that your team can verify the cardholder's identity. After verifying the identity, you can activate the network token by making an API request to Adyen.

The provisioning flow with phone call authentication is as follows:

1. The provisioning process is initiated.
2. Adyen creates the network token with an **inactive** status.
3. Adyen sends a webhook to inform your server that a network token was created.
4. Adyen performs a risk analysis using the information in the network token request.
5. Adyen notifies your cardholder that they need to contact your call center, so their information can be authenticated.\
   Adyen also sends a webhook to your server to notify you of this requirement.
6. Your cardholder contacts your call center.
7. If the authentication is successful, you make a PATCH [/networkTokens/{networkTokenId}](https://docs.adyen.com/api-explorer/balanceplatform/latest/patch/networkTokens/\(networkTokenId\)) request to change the status of the network token to **active**.
8. Adyen sends the network token and the card details to the card scheme.
9. The card scheme stores the network token and the card details.
10. The card scheme sends the network token to the digital wallet.
11. The digital wallet stores the network token.

The following diagram shows the provisioning flow with phone call authentication:

[![](/user/pages/docs/07.issuing/18.tokens-digital-wallet/phone-call-auth-required.svg)](/user/pages/docs/07.issuing/18.tokens-digital-wallet/phone-call-auth-required.svg)

### Tab: Token closed automatically

Adyen closes the token automatically when:

* The risk analysis determines that there is high risk associated with creating the network token and you have not enabled call center authentication.
* The information in the network token request is incorrect or incomplete.

In these cases, Adyen closes the network token and ends the provisioning flow.

To reduce the chance of automatic closure, you can:

* Make sure that the cardholder's [authentication data](/issuing/tokens-digital-wallet/authentication-data) (phone number or email) is linked to their card, so that Adyen can use two-factor authentication.
* If your user is adding their card using a device with high risk score, advise your cardholder to try using a different device. Devices with high risk score can cause an automatic closure.

The provisioning flow is as follows:

1. The provisioning process is initiated.
2. Adyen creates the network token with an **inactive** status.
3. Adyen sends a webhook to inform your server that a network token was created.
4. Adyen performs a risk analysis using the information in the network token request.
5. If the information cannot be validated successfully, Adyen changes the status of the network token to **closed**.
6. Adyen sends a webhook to inform you about the decision.

The following diagram shows a provisioning flow that ends after closing a network token.

[![](/user/pages/docs/07.issuing/18.tokens-digital-wallet/token-closed-automatically.svg)](/user/pages/docs/07.issuing/18.tokens-digital-wallet/token-closed-automatically.svg)

## Next steps

[required](/issuing/tokens-digital-wallet/authentication-data)

[Configure authentication data](/issuing/tokens-digital-wallet/authentication-data)

[Learn how to configure your user's authentication data to verify their identity when adding their card to a digital wallet.](/issuing/tokens-digital-wallet/authentication-data)

[required](/issuing/tokens-digital-wallet/apple-pay-provisioning)

[Apple Pay in-app provisioning](/issuing/tokens-digital-wallet/apple-pay-provisioning)

[Learn how to integrate Apple Pay in-app provisioning.](/issuing/tokens-digital-wallet/apple-pay-provisioning)
