Library · Payment orchestration · How to run this
Tokens do not all follow you off a gateway
You are leaving a gateway. The CRM still has “cards on file.” That string is not a PAN. Network tokens, processor tokens, and PAN in a PCI vault migrate on different paths. Mixing them invents a silent cutover that fails the first rebill.
Pair: Vault token migration checklist on Payment orchestration. One dead token on a live gateway: clear-PAN retry. MIT chain after a new seat: rebill original-sale.
What has to be true
Name the credential type per stored card — network token (Visa/MC), processor token (NMI / this acquirer), or PAN you still hold under PCI. If you cannot name it, assume re-collect.
Written export from the leaving vault, in a format the receiving gateway said it will ingest. A CSV of tokens is not an ingest.
Test bill on a migrated token before you cut traffic. A sandbox “imported” flag is not a capture.
Re-collect plan for the rest — email, checkout wall, continuity pause. Shopper-present new card starts a new MIT chain; keep original-sale rules.
PCI / SAQ change if PAN will sit somewhere new. Account updater enrollment on the new seat is not the migration.
Boxes start off. We do not tick a typical vault.
What not to do
Do not pitch a vendor as the page. Do not assume Apple Pay / wallet tokens move with card tokens. Do not cut the old MID before the test bill. Do not hop dead processor tokens as a cascade.
Related: Payment orchestration, clear-PAN retry, token kill vs updater, rebill original-sale, leave a PayFac.
Procedure
- Name network token vs processor token vs PAN per stored card.
- Get a written export the receiving vault will ingest.
- Test-bill a migrated token before cutover.
- Re-collect the rest. Keep original-sale rules on new cards.
Failure modes
- Assuming every card-on-file bills on the new gateway day one.
- Pasting a vendor portability chip.
- Cutting the old MID before a live test bill.
- Treating wallet tokens as card tokens.
Worked example
None on this page yet. When one lands it will be a real case: what broke, the number, and what changed. Not a composite.
Glossary
- Processor token
- A credential that only that gateway can bill. Often dies at cutover unless a contracted vault export lands.
Work with us — We run this job on your accounts. Services
FAQ
- Will every stored card bill on the new gateway on day one?
- No. Processor-only tokens often die at cutover. Network tokens and a contracted vault export may survive. Re-collect the rest.
- Is this clear-PAN retry?
- Related. [Clear-PAN retry](/manuals/clear-pan-retry) is one dead token on a live gateway. This page is leaving the vault.
- Can I paste a Spreedly / NMI “full portability” line?
- No. Tick what this contract and test bill actually did. We invent no portability chip.