# Enroll a Card with MDES Token Connect
source: https://developer.mastercard.com/issuer-enrollment/documentation/use-cases/push-provisioning/mdes-token-connect/index.md

This guide is for issuers using the Mastercard Digital Enablement Service (MDES) Token Connect APIs to manage customer-initiated push provisioning into Click to Pay. After a cardholder selects an eligible card and provides consent, this integration uses MDES Token Connect to start push provisioning and redirect the cardholder to Click to Pay to complete enrollment. Click to Pay returns the provisioning result to your app or website.
Note: Push provisioning currently supports enrollment into Click to Pay only.

### Prerequisites {#prerequisites}

* Complete the [Quick Start Guide](https://developer.mastercard.com/issuer-enrollment/documentation/quick-start-guide/index.md#before-you-begin) prerequisites.
* Enroll in MDES to activate payment cards and receive token requests.
* Perform strong cardholder authentication before starting push provisioning. Do not request additional cardholder authentication during push provisioning.
* Identify eligible cards and present the Click to Pay option in the issuer app or website.
* Obtain the cardholder's consent before submitting the selected card.

## Enroll a Card in Click to Pay Workflow {#enroll-a-card-in-click-to-pay-workflow}

Use the [MDES Token Connect APIs](https://developer.mastercard.com/mdes-token-connect/documentation/api-reference/) when you want Mastercard to manage the tokenization and provisioning flow; your application initiates the process and handles the callback and redirect steps needed to complete enrollment.

### Example sequence {#example-sequence}

Diagram pushprov_addcards_MDES_token_connect

1. Cardholder logs into your app or website.

2. To present the Click to Pay enrollment option, send the following MDES Token Connect API requests:

   * [`POST .../getEligibleTokenRequestors`](https://developer.mastercard.com/mdes-token-connect/documentation/api-reference/#tag/Get-Eligible-Token-Requestors) to retrieve information about eligible Token Requestors, including any image asset IDs.
   * [`GET .../asset/tokenrequestor/{AssetId}`](https://developer.mastercard.com/mdes-token-connect/documentation/api-reference/#tag/Get-Assets) with the asset ID to display the Click to Pay logo in your app or website.  

3. Display the list of cards eligible for Click to Pay enrollment.

4. Cardholder selects the card they want to enroll, reviews prepopulated billing and contact details, and provides consent to enroll in Click to Pay.

5. Send a [`POST .../pushMultipleAccounts`](https://developer.mastercard.com/mdes-token-connect/documentation/api-reference/#tag/Push-Multiple-Accounts) request with the Click to Pay Token Requestor Identifier (TRID) and card details to initiate tokenization and push provisioning.

6. MDES tokenizes and provisions the card and returns the `callbackURL`, `pushAccountReceipt`, and other information required to build the Click to Pay browser experience URL. If `tokenRequestorSignatureSupport` is `true` and MDES returns at least one `pushAccountReceipt`, the response also includes a `signature`.

7. Build the Click to Pay [redirection URL](https://developer.mastercard.com/mdes-token-connect/documentation/tutorials-and-guides/issuer-implementation-guide/) to redirect the cardholder to the Click to Pay details page, with the option to select **Remember Me** to store a cookie in the browser. Include the following parameters as required:

   * If the Token Requestor supports `signature` verification, pass it in the `pushAccountData` parameter for enhanced security.
   * Set the `locale`, for example, `locale=en_US`.
   * Include the `callbackURL`. For example, `callbackURL=https%3A%2F%2Fpartnerbank.com%2Ftokenization-results`.
   * Set `extFlow=true` to enable the **Remember Me** experience.

   * Curl

   ```curl
    https://src.mastercard.com/provision?pushAccountData=eyJhbGciOiJSUzI1NiIsImtpZCI6IjIwMjEwOTI3MDkxMzQwLU1ERVMtdG9rZW4tY29ubmVjdC1tdGYifQ.eyJwdXNoQWNjb3VudFJlY2VpcHRzIjpbIk1DQy1TVEwtREMzNTEyNkMtMjgwQS00MDc3LThGNDMtOEZDRDAwQUU3MjQxIl0sImNhbGxiYWNrVVJMIjoiaHR0cHM6Ly9zdGFnZS50b2tlbmNvbm5lY3QubWNzcmN0ZXN0c3RvcmUuY29tL3Rva2VuaXphdGlvbi1yZXN1bHRzIiwiY29tcGxldGVXZWJzaXRlQWN0aXZhdGlvbiI6dHJ1ZSwiYWNjb3VudEhvbGRlckRhdGFTdXBwbGllZCI6dHJ1ZSwibG9jYWxlIjoiZW5fVVMifQ.FFEJjbOoEiJV18lTGlnlvjDt-b7s4DvGef5WMq-Ncm1neh5PXE-srcqBt_01tvDgXcAN_izj_624KPeEBbQg_F2EZ5CDmKC0GLNbZhWuefv1gT9pGE0wX_-e6Nz7wF6X8vRXE8uaulz7g-30wYz-Ek4vjIc_rSESP2_oZFCxbPLq-FVTls2QA3x8DF_mH8GBAVNe2pkT-Eh_IsnQ5OhrG3liVVVeshNqxmUmMgSdNdf-m6s5WE_fCytQ_Jrf4gH-Vq3pZMifko7uYxYK5cz6OsZ1O7UA_Pyes8UCFYrMPI9M8iEdoav6tsfpXyCA9rmufEOa-YnREwc4swjgbtXDSA&locale=en_US&extFlow=true
   ```

   * Curl

   ```curl
    https://src.mastercard.com/provision?pushAccountReceipts=MCC-STL-04FB7337-2308-4312-9433-C608BC1C391B&accountHolderDataSupplied=true&locale=en_US&completeIssuerAppActivation=false&completeWebsiteActivation=false&extFlow=true&callbackURL=https%3A%2F%2Fpartnerbank.com%2Ftokenization-results
   ```

8. After the cardholder selects the redirection URL, Click to Pay completes enrollment and profile creation and displays a confirmation that the card was successfully added and is ready to use.

9. The cardholder selects 'Return to Bank'. Click to Pay redirects the cardholder to your app or website using the callBackURL you provided.

   * Curl

   ```curl
   https://partnerbank.com/tokenization-results?results%5BMCC-STL-04FB7337-2308-4312-9433-C608BC1C391B%5D=APPROVED%7CDWSPMC000000000132d72d4fcb2f4136a053
   ```

10. Click to Pay sends you the card provisioning result and token reference after successfully tokenizing the card. To learn how to process the response, see the MDES [Push Provisioning Implementation Guide](https://developer.mastercard.com/mdes-token-connect/documentation/tutorials-and-guides/issuer-implementation-guide/#receive-response-from-token-requestor).

## Enrollment User Experience {#enrollment-user-experience}

Cardholders may experience three scenarios during push provisioning and card enrollment.

### Enrollment without additional verification {#enrollment-without-additional-verification}

The cardholder's profile is created when they add and enroll a card in Click to Pay through the issuer app or website. The issuer prepopulates the cardholder's personally identifiable information (PII), so no additional verification is required in this scenario.

![Provision cards into SRC](https://static.developer.mastercard.com/content/issuer-enrollment/documentation/img/demo_provision_cards_src_returntoappR020_updated.png "Provision Cards into SRC")

### Enrollment with additional verification {#enrollment-with-additional-verification}

The cardholder requests to add a new card to an existing Click to Pay profile from the issuer app or website. Click to Pay determines whether additional verification, such as one-time password (OTP) verification, is required.

![OTP Verification](https://static.developer.mastercard.com/content/issuer-enrollment/documentation/img/pp_otp_verification_02.png "Mastercard Click to Pay Push Provisioning OTP Verification")

### Cardholder cancels card enrollment {#cardholder-cancels-card-enrollment}

After signing in to the issuer app or website and selecting a card to add to Click to Pay, the cardholder can choose Cancel instead of Continue. Card enrollment is canceled, and the cardholder is redirected to the issuer app.

![Provision Cancelling](https://static.developer.mastercard.com/content/issuer-enrollment/documentation/img/pp_cancelling_03.png "Mastercard Click to Pay Push Provisioning Cancellation")
Note: UX images are for illustrative purposes only.

## Error Resolution {#error-resolution}

Use the [Testing guidance](https://developer.mastercard.com/issuer-enrollment/documentation/testing/index.md) to validate your integration. For MDES Token Connect errors, see [Codes and Formats](https://developer.mastercard.com/issuer-enrollment/documentation/code-and-formats/index.md) and the [MDES Token Connect error reference](https://developer.mastercard.com/mdes-token-connect/documentation/code-and-formats/).

## Next Steps {#next-steps}

* Retrieve, update, or delete a consumer's profile or associated credentials. For more information, see [Manage Consumer Profiles and Credentials](https://developer.mastercard.com/issuer-enrollment/documentation/use-cases/auto-enrollment/life_cycle/index.md).