# Secure Card on File source: https://developer.mastercard.com/mastercard-checkout-solutions/documentation/use-cases/card-on-file/index.md Consumers prefer to save their card information (Primary Account Number or PAN, and expiry date) for e-commerce transactions to avoid re-entering their credentials. However, storing that information online without protection can expose consumers to online frauds and data breaches. **What is Network Tokenization?** Network Tokenization helps businesses protect consumers from fraud and improve transaction approval rates. It replaces a consumer's PAN with a Network Token, which is a payment credential specific to a consumer card and merchant combination. **What is Secure Card on File?** Secure Card on File (SCOF) is a Mastercard solution that enables merchants, commerce platforms, and payment service providers (PSPs) to replace cardholders' PANs with unique tokens. These tokens can be used for e-commerce and in-app transactions in the same way as a PAN. Secure Card on File ensures payment credentials are securely stored -- reducing fraud, improving approval rates and enabling seamless consumer experiences. To learn more about key benefits, visit the [Card on File Tokenization](https://developer.mastercard.com/mastercard-checkout-services/product/card-on-file-tokenization/) home page. ## Who is Secure Card on File for {#who-is-secure-card-on-file-for} Secure Card on File is available to a variety of customers who are categorized into one or more Program Types based on their business model. These program types are defined by Mastercard Checkout Solutions: | Program Type | Description | |------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Merchant** | Merchants who store cardholder's credentials, tokenize the credentials, and use the token and cryptogram to process the cardholder's payment at the merchant's app/website. | | **Commerce Platform** | Wallet Providers who store cardholder's credentials and share token and cryptogram to integrated third-party merchants. Wallet Providers can provide wallets in their own ecosystems (such as a social media marketplace, connected car) or within an integrated third-party merchant's checkout experience (such as a 'pay-with' button). | | **On-Behalf-Of Merchant** | Payment Service Providers (PSP) who offer tokenization services to their merchants. | | **On-Behalf-Of Commerce Platform** | Payment Service Providers, classified as a Technical Enabler, who offers tokenization services to Commerce Platforms. The Commerce Platform must be a registered customer of Mastercard. | | **On-Behalf-Of Sub-Merchant** | Payment Service Provider, classified as Payment Facilitator, who offers tokenization to their sponsored merchants. | Learn more about how to [register your entities](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/use-cases/card-on-file/register_entities/index.md) to create tokens. ## Use Cases and Applicable APIs/SDKs {#use-cases-and-applicable-apissdks} Review the use cases and the applicable APIs to achieve the expected results depending on if an entity registering is a Merchant, or a Commerce Platform. | Use Case | Description | Requirement | |------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------| | [**Register Entities to Create Tokens**](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/use-cases/card-on-file/register_entities/index.md) | Submit merchant onboarding information for each consumer-facing entity name (`programName`) using the [Merchant Registration API](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#registration) or the [Mastercard Connect portal](https://www.mastercardconnect.com/-/sign-in). *On-Behalf-Of* Program Types should use the Merchant Registration API to register their customers. *Merchants* and *Commerce Platforms* should use the Mastercard Connect Portal to register their entities. | Required for all Program Types | | [**Create Tokens**](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/use-cases/card-on-file/create-tokens/index.md) | Generate a unique token for the card using the [Enroll Card API](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#card). | Required for all Program Types | | [**Make Payments**](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/use-cases/card-on-file/making-payments/index.md) | Retrieve token details and cryptogram from the [Checkout API](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#checkout) to help cardholder to make payments. Submit the token and cryptogram for payment authorization. | Required for all Program Types | | [**Manage Tokens**](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/use-cases/card-on-file/managing-tokens/index.md) | * Receive and respond to [Card Notification events](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#notifications) regarding card details, PAN expiration, account suspension, etc. to get token updates. * Delete the token using the [Delete API](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#card) with the specific card identifier when a cardholder/Integrator wants to remove a card. | Required for all Program Types | | [**Display Tokenized PAN Details**](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/use-cases/card-on-file/displaying-tokenized-pan-details/index.md) | Fetch the most updated PAN (token) details and display tokenized PAN details associated with a profile, using the [Get Card API](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#card). | Optional for all Program Types | | **Receive Transaction Notification** | Receive transaction notifications generated by Mastercard Checkout Solutions (MCS) if the Issuer of the card used to make payment supports Transaction Detail Service (TDS), using [Card ID API](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/use-cases/card-on-file/making-payments/index.md). | Optional -- Only Available to Commerce Platforms | | [**Perform Authentication**](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/use-cases/card-on-file/token-auth-framework/index.md) | Enhance security and performance of remote commerce transactions by PAN tokenization and cardholder authentication with [Token Authentication Framework](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/token-authentication/index.md) using [Look Up Cardholder Authentication Methods](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#authentication) and [Authentication Invocation SDK](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/integrate_apis_scof/step5/index.md). | Required for all Program Types | Note: [Card Notifications](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#notifications), [Push Transaction Details](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#notifications), and [DPA Status Notifications](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#notifications) are outbound API endpoints. These endpoints are required to receive notifications and to allow to push payload information to Mastercard Checkout Solutions for authorization purposes. To be able to receive notifications related to the tokenized card and transactions from Mastercard, you will need to: * Have a listener application that exposes an endpoint to receive the notifications. * Ensure the API is implemented as per the specifications defined in this page. * Share the URL that you would want Mastercard to use to push notifications to. * Set up MTLS (Mutual Transport Layer Security) connectivity. You will need access to the Key Management Portal (KMP) application on Mastercard Connect to be able to request certificates. KMP application provides an inventory of all PKI for Business Partners keys and certificates that have been exchanged between Mastercard and customers. Your [Mastercard representative](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/support/index.md#get-help) will guide you through this process.
Mastercard supports encryption of [Card Notifications](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#notifications) and [Push Transaction Details](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#notifications) API endpoint, if required. Reach out to your Mastercard representative for more details. ## Next Steps {#next-steps} * Start with the [onboarding and registration](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/onboarding-sandbox/index.md) to enroll into programs, create projects, generate [necessary API keys](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/key-management/index.md) to test a project in Sandbox. * Follow the [Integrate with Secure Card on File](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/integrate_apis_scof/index.md) tutorial to integrate with Secure Card on File. * Complete integration and testing in sandbox, and complete all the required steps to [go live in Production](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/onboarding-production/index.md).