Introduction to In-App Provisioning

In-App Provisioning is a process where the Program Manager (i.e., your systems) pre-authenticates the cardholder before the first token provisioning message is sent to the token service provider (Visa/Mastercard). For information on the requirements for cardholder authentication, discuss with your mobile wallet token requestor.

In-App Provisioning requires you to share sensitive card data held on your system with the token service provider (without the cardholder needing to manually enter the PAN details into their mobile application). The cardholder must be logged into their account (i.e., logged in to their mobile application) in order to be able to authenticate.

The figure below describes the In-App Provisioning process.

1. The cardholder confirms the card to be added to their mobile phone application for your service.
2. Your mobile phone app requests encrypted card data for In-App Provisioning from the token requestor (e.g., Apple and Android).
3. The token requestor returns the data.
4. Your mobile app sends data to your server.
5. Using a valid REST API authorisation token, your server calls either the Request Apple Payload endpoint (for Apple Wallet users), or the Request Google Payload endpoint (for Google Wallet users).
6. Thredd creates an encrypted payload and returns it to your server.
7. The server sends the encrypted data to the mobile phone app.
8. The encrypted data is passed to the token requestor from the phone app.
9. The token requestor initiates provisioning with the Token Service Provider, which decrypts the card data and starts the token provisioning flow.

📘

Documentation

For more information on the In-App Provisioning endpoints, see:

• Request Google Payload
• Request Apple Payload