# June 2025 Pre-Release Notes
source: https://developer.mastercard.com/mdes-token-connect/documentation/pre-release-notes/prereleasenote_june2025/index.md

This site provides the release information of the MDES Token Connect API for the June 2025 release.

## Release Change Summary {#release-change-summary}

The July 2025 release of the MDES Token Connect platform introduces support for Pull Provisioning, enabling issuers to provide a seamless and secure card digitization experience.

## Release Dates {#release-dates}

* MTF - ~~25 June 2025~~ 9 July 2025
* Production - ~~14 July 2025~~ 6 August 2025

### Impacted Market {#impacted-market}

Functionality Available - Global

### Change 1 -- Pull Provisioning Device Support {#change-1--pull-provisioning-device-support}

Pull provisioning allows a token requestor such as a digital wallet or merchant application to directly access the payment account details from the issuer's system. This capability allows token requestors to initiate provisioning by redirecting cardholder to the issuer's environment where they can authenticate and select eligible cards for tokenization.

**Pull Provisioning flow**

Diagram pull_provisioning_flow

New parameters `authenticationCode` and `tokenRequestorSessionId` have been introduced for issuers to support pull provisioning in the pushMultipleAccounts API.

|                                                            Field and Description                                                            |       Data Type        | Min Length | Max Length | Required |
|---------------------------------------------------------------------------------------------------------------------------------------------|------------------------|------------|------------|----------|
| **authenticationCode** The authentication code entered by the cardholder in the Issuer App. Wallet app provides the code to the cardholder. | String (Alpha-Numeric) | 1          | 32         | No       |

|                                       Field and Description                                       |       Data Type        | Min Length | Max Length | Required |
|---------------------------------------------------------------------------------------------------|------------------------|------------|------------|----------|
| **tokenRequestorSessionId** The session Id provided by the token requestor for pull provisioning. | String (Alpha-Numeric) | 3          | 64         | No       |


API Reference: `GET /connect/{maj}/pushMultipleAccounts`

### Key Information for Issuers {#key-information-for-issuers}

#### Integration Requirements {#integration-requirements}

* Enable redirection support across Android, iOS, and Web platforms.
* Provide essential issuer metadata, including logo, display name, and relevant URLs.
* Implement updated cardholder authentication and card selection flows in accordance with the latest integration guidelines.

### Cardholder Experience Flow {#cardholder-experience-flow}

1. Cardholder initiate the process within the token requestor's app.
2. Cardholder is redirected to the issuer's app or web portal for authentication.
3. Upon successful login, cardholder selects the cards they wish to provision.
4. The selected card data is securely transmitted back to the token requestor for tokenization.

### Security and Compliance {#security-and-compliance}

* No PCI (Payment Card Industry) or PII (Personally Identifiable Information) data is exchanged during the redirection process.
* Signature verification and random number validation are used to ensure authenticity and data integrity.
* Issuers must comply with applicable data protection laws and regulations.

## Impact {#impact}

### Onboarding/Configuration {#onboardingconfiguration}

To enable pull provisioning, issuers are required to provide metadata such as redirection URLs, a logo image, and a display name during onboarding. For more details, contact your regional Mastercard representative.
Note: By default, all issuers are not enabled for pull provisioning.

### Mandate for Implementation {#mandate-for-implementation}

Once this functionality is available commercially, Mastercard recommends that the issuer support the pull provisioning functionality.
Note: Token Connect Push provisioning support is a pre-requisite to support pull provisioning.

### Personal data and Privacy Note {#personal-data-and-privacy-note}

Issuers are reminded that the information presented via the Token Connect includes personal data which is subject to data privacy laws. Issuer must satisfy themselves that the processing of such personal data is compliant with applicable privacy laws.