How card on file works
The cardholder agrees to the storage during a first payment, or during a card check for no amount. The details are kept as a token in the gateway's vault or as a network token, and each later payment carries an indicator that a stored credential was used.
The indicator comes with a second one saying who started the payment: the cardholder, as in a one-click purchase, or the merchant, as in a subscription renewal.
What the scheme rules say
In the Visa Core Rules of 18 April 2026, after the cardholder's agreement and before the first transaction, a merchant submits an authorisation request for the amount or, if no payment is due, an account verification. If that request is not approved, the merchant must not store the credential.
Mastercard's Transaction Processing Rules of 9 June 2026 describe a credential-on-file transaction as one where the cardholder expressly authorises a merchant to store the card number and expiry date for later use. The transaction carries the credential-on-file indicator together with a cardholder-initiated or merchant-initiated indicator.
Why card on file matters
Stored cards make repeat purchases and subscriptions possible. They also bring duties: holding card numbers is within PCI DSS, cards expire and are reissued, and a wrong flag leads to declines.
Card on file, network token or one-click payment?
- Network token
- A substitute for the card number issued by the card scheme. A card on file can be stored as a network token or as a card number in a vault.
- One-click payment
- The checkout feature that a card on file makes possible, started by the cardholder.
Where card on file shows up in a platform
Modules that do the work
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
Platforms that need it
Guides that go deeper
Where it is written
The laws and standards this page's facts come from.
- Visa Core Rules and Visa Product and Service Rules, 18 April 2026: Table 5-22 and the glossary, Stored Credential (Visa)
- Mastercard Transaction Processing Rules, 9 June 2026: 5.3, Credential-on-File Transactions (Mastercard)
General information, not legal advice: what applies to you depends on your services and your market.