On this page
No Headings
Last updated: June 16, 2026
PayPal supports third-party network token processing for merchants and partners.
This integration is available:
For more information, contact Sales.
Tokenization keeps payment information private by turning card numbers into unique tokens, which are stored securely and used instead of the original card.
Tokenization creates a unique credential, or token, for a card that is different from its 15- or 16-digit primary account number. The merchant sends only the token rather than the underlying account number. A network token works exclusively for a specific card and merchant.
The benefits of using network tokens include:
A third-party network token represents a payment method that is either:
Third-party network token processing occurs when PayPal processes a payment using a token that PayPal did not create.
Integrate with third-party network token payments as follows:
Note: Third-party tokens are not stored and cannot be created, mapped, unmapped, or validated against their primary account number.
Note: Third-party network token integrations don't support reference or future transactions. Don't pass a reference transaction ID using the payment_source.token.id parameter.
Review this section to learn how to integrate third-party network tokens in your multiparty PayPal integration.
This code sample shows a third-party network token in the body of a POST call to the Create order endpoint of the Orders v2 API. This multiparty request creates a new order and completes the payment in a single step by declaring the intent as CAPTURE:
The payment request includes the new network_token and stored_credential objects:
curl -v -X POST https://api-m.sandbox.paypal.com/v2/checkout/orders \
-H 'Content-Type: application/json' \
-H 'PayPal-Request-Id: REQUEST-ID' \
-H 'Authorization: Bearer ACCESS-TOKEN' \
-d '{
"intent": "CAPTURE",
"purchase_units": [
{
"reference_id": "REFID-000-1001",
"description": "Item bought at This Store",
"custom_id": "1111",
"soft_descriptor": "",
"amount": {
"currency_code": "USD",
"value": "100.00"
},
"shipping": {
"address": {
"address_line_1": "123 Main St.",
"address_line_2": "",
"admin_area_2": "Anytown",
"admin_area_1": "CA",
"postal_code": "12345",
"country_code": "US",
},
},
"payee": {
"email_address": "[email protected]"
}
}
],
"payment_source": {
"card": {
"name": "Firstname Lastname",
"network_token": {
"number": "4420567383232198",
"expiry": "2030-11",
"eci_flag": "NON_3D_SECURE_TRANSACTION",
"token_requestor_id": "12324",
},
"stored_credential": {
"payment_initiator": "MERCHANT",
"payment_type": "UNSCHEDULED",
"usage": "SUBSEQUENT",
"previous_network_transaction_reference": {
"id": "123456789016848",
"network": "VISA"
}
}
}
}
}'Lines 35-40: The payment_source.card.network_token object contains details about the third-party network token. PayPal passes this information to the issuer. See network_token for more details.
Line 38: Token service providers give each third-party network token a 2-digit Electronic Commerce Indicator (ECI) code. When you make a payment using a third-party network token, your integration needs to change the 2-digit ECI code to the corresponding string from the following table. Pass this value using the payment_source.card.network_token.eci_flag parameter. This value is required for customer-initiated payments and optional for merchant-initiated payments:
| Numeric ECI code | String |
|---|---|
00 | MASTERCARD_NON_3D_SECURE_TRANSACTION |
07 | NON_3D_SECURE_TRANSACTION |
Lines 25-33: The payment_source.card.stored_credential object contains details about the type of card-on-file payment. See stored_credential for more details.
The HTTP 201 response includes the new bin_details and network_transaction_reference objects:
{
"id": "1C882901H6992113A",
"status": "COMPLETED",
"payment_source": {
"card": {
"name": "Firstname Lastname",
"last_digits": "7287",
"expiry": "2030-11",
"brand": "VISA",
"available_networks": [
"VISA"
],
"type": "CREDIT",
"bin_details": {
"bin": "43999450",
"issuing_bank": "CREDIT UNION OF OHIO",
"bin_country_code": "US"
}
}
},
"purchase_units": [
{
"reference_id": "REFID-000-1001",
"payment_instruction": {
...
},
"shipping": {
...
},
"payments": {
"captures": [
{
"id": "3BJ29575M0175253F",
"status": "COMPLETED",
"amount": {
"currency_code": "USD",
"value": "50.00"
},
"final_capture": true,
"disbursement_mode": "DELAYED",
"seller_protection": {
"status": "NOT_ELIGIBLE"
},
"seller_receivable_breakdown": {
...
},
"invoice_id": "INVID-21-07-2023-05-56-55",
"custom_id": "CUSTOMID-1001",
"links": [
...
],
"create_time": "2023-07-21T12:27:00Z",
"update_time": "2023-07-21T12:27:00Z",
"processor_response": {
"avs_code": "Y",
"cvv_code": "X",
"response_code": "0000"
},
"network_transaction_reference": {
"id": "054706134140378",
"network": "VISA"
}
}
]
}
}
],
"links": [
...
]
}payment_source.card.bin_details object contains the bank identification number (BIN) information. See bin_details for more details.purchase_units.payments.captures.network_transaction_reference object includes the id and network name. See network_transaction_reference for more details.