Token Creation Process
The tokenization process is relatively simple, the cardholder enters his card information in a merchant or wallet, this merchant connects with VISA services through a Token Service Provider and VISA with the card information when identifying the BIN communicates with the issuer through another Token Service Provider.
The following diagram shows the whole endpoint that interviews in the token creation cycle. Issuers will need all endpoints that you see in the issuer pool.
Green Path:
The green path is the process of automatic activation of a created token.
This occurs when the Issuer has configured it in the rules of the card schema and when the card is enrolled in the bank's app/wallet.
And when the token requestor is a merchant habilitated in ecommerce and card on file.
Or when the requestor is a third-party wallet such ApplePay®, GooglePay®, SamsungPay®, FitbitPay®, GarmingPay® or Click to pay; when the client onboarding flow was initiated by the issuer’s wallet through PushProvisioning Services.
Yellow path:
Steps 3 to 6 on the diagram.
The yellow flow is a token creation flow, with a pending activation, that depends on the confirmation by the cardholder. It is used when the Token Requestor (TR) is not related with the card Issuer or even if the Issuer wants it, it can be configured so that its enrollment requires a user's identity validation.
The identity validation that is carried out with a single-use OTP numerical sequence, that the card schema generates and sends to the Issuer, so that the Issuer sends it to the cardholder.
The sending of OTP can be done by SMS, e-mail, or call telephone. The code that the cardholder receives must be entered in the Requestor Token service so that the assigned token is finally enabled. At the end of the authorization process, the Issuer is going to receive a Notification.
Orange Path:
The Orange Path is only applicable to Third-Party Wallets like ApplePay®, GooglePay® and in this case the only way to activate the token is through a direct call between the cardholder and Issuer. This path is taken when the security level of the Wallet Account, or the device qualification is considered insecure.