Provisioning Overview

Provisioning is the process by which a token requestor, usually a wallet, asks for a token to be created for a card. This is where your integration work is.

The path

%%{init: {"sequence": {"actorMargin": 8, "boxMargin": 6, "noteMargin": 6, "messageMargin": 26, "width": 110, "diagramMarginX": 8, "diagramMarginY": 8}}}%%
sequenceDiagram
    autonumber
    participant CH as Cardholder
    participant W as Wallet
    participant MC as Mastercard MDES
    participant UDT as UnDosTres
    participant P as You

    CH->>W: Starts adding the card
    W->>MC: Requests a payment token
    MC->>UDT: Sends for verification
    UDT->>P: AdministrativeMessage
    UDT-->>MC: Provisioning decision
    MC->>MC: Generates token, stores PAN
    MC-->>W: Returns the token
    W-->>CH: Card appears in the wallet

1. The cardholder starts the request, by push provisioning or manual provisioning.
2. The wallet requests a payment token from the card network.
3. The network starts the approval process and passes the request to UnDosTres for verification.
4. UnDosTres makes the provisioning decision and relays it to the network. UnDosTres also notifies you, using the AdministrativeMessage method, of the attempt.
5. If authorized, the network generates the token, stores the mapping in its vault.
6. The token is delivered to the wallet.

Push versus manual

There are two ways a cardholder can get a card into a wallet, and they behave differently.

The reason push provisioning needs no OTP is that the cardholder is already authenticated. They are inside your app, which means you have already established who they are. Manual provisioning has no such guarantee, because anyone who can read a card number could type it into a wallet, so the cardholder must prove ownership with a one-time code.

Wallet behaviour

Apple Pay and Google Pay behave identically: an OTP is issued for manual provisioning, and no OTP for push provisioning.

Samsung Pay is different. Samsung Pay does not issue an OTP, for either manual or push provisioning. On a Samsung Pay manual provisioning you will simply receive digitization.complete telling you the token was created.

Wallet IDs

Each wallet is identified by a three-digit Wallet ID, returned as wallet_id on ListActiveTokens and ListAllTokens.

🚧

Confirm before you branch on these values. The wallet ID list above is the published Mastercard-ecosystem numbering. The exact values issued on this programme are being confirmed. Do not build hard branching logic on wallet_id until we confirm the list in writing. Store the value, display it if you like, but treat a wallet-specific code path as pending.

What UnDosTres does, and what you do

🚧

One open point on the decision step. On some configurations the issuer is asked to confirm card eligibility synchronously before the decision is made, which would add an endpoint to your scope. On this programme UnDosTres currently makes that decision from its own card data and does not call you for it. We are confirming this in writing and will update this page. If it changes, we will tell you before it affects your build.

Related

• Manual Provisioning — the full callback sequence
• Push Provisioning — the in-app path
• Token Lifecycle Management — what happens afterwards