Tokenization by Link: How to Collect Card Details Without a Checkout

A guest calls the hotel to guarantee a late arrival. A customer emails to update the card on their account. A support agent fixes a failed booking in a live chat. A sales rep closes a deal over the phone and needs payment details to finish it.

None of these moments happen in a checkout, but every one of them needs a card. The quickest way to get it is also the riskiest: "Just read me the number," or "Reply with your card details." From then on, that card number lives in a call recording, an inbox or a chat transcript, none of which was ever built to hold card data.

In this API Spotlight, we look at Tokenization by Link: what it is, who it's for, and how it lets teams collect cards anywhere without card data ending up where it shouldn't.

What is Tokenization by Link?

Tokenization by Link is a way to collect card details through a secure page that PCI Proxy hosts for you. Your system asks PCI Proxy for a link, your team shares it with the customer through whatever channel they're already using, and the customer enters their card on PCI Proxy's page. The card goes straight into the PCI Proxy vault, and you receive a token in return.

The easiest way to picture it is as a payment link without the payment. Instead of charging the card on the spot, Tokenization by Link stores it and hands you a token, which you can then use for a payment, a deposit, a booking guarantee or a future charge. When you need extra security, the same page can run 3D Secure authentication while the card is being collected.

The reason this matters is the way PCI DSS defines scope. Any system that stores, processes or transmits card data is in scope, and that isn't limited to payment systems. A phone system that records calls, a helpdesk that stores tickets or a mailbox that keeps customer emails all come into scope the moment a card number lands in them. Securing and auditing every one of those tools is expensive. Keeping card data out of them is far simpler, and that's exactly what a link does.

How Tokenization by Link works

Behind the scenes, a link is created with a single request from your system. Along with it, you can pass your own reference, such as a booking or customer number, so the result is easy to match later, and an address to send the customer to once they're done. PCI Proxy returns a unique URL, and that's all your team needs to share.

The customer opens the link on any device, sees a page that carries your logo, your colors and, if you like, a few lines of context such as their booking number or name, and enters their card. As soon as they submit it, the card is stored in the vault and your system is notified, either through a webhook or by checking the link's status. Each link can be used only once, but until then it doesn't expire, so customers can complete it whenever it suits them. If a booking is canceled before that happens, the link can simply be deleted.

What comes back to your system is everything you need to continue, without the card number itself: the token, a masked version of the card number, the expiry date, the cardholder name if you asked for it, and details such as the card brand and issuing country. If 3D Secure ran, the authentication results are included too.

Who Tokenization by Link is for

Tokenization by Link is for businesses that need cards from customers outside a regular online checkout. Hotels, tour operators and travel agencies taking bookings by phone or email are the most common users, followed closely by customer support and sales teams, B2B platforms and back-office tools that have no checkout of their own.

For the operations and payment managers who run those teams, it replaces informal and risky habits with a simple, consistent process that agents can follow on every call or ticket. For developers, it offers secure card collection in any channel without building, hosting or maintaining a payment form.

If your customers are already checking out on your website or in your app, an embedded form like Secure Fields or the Mobile SDKs will usually give them a smoother experience. Tokenization by Link shines everywhere else.

Tokenization by Link use cases: phone bookings, support and B2B

Taking cards out of phone and email bookings

Hotels, tour operators and travel agencies still take a large share of bookings by phone or email. Instead of noting down a card number, the agent creates a link and sends it to the guest while still on the call. The booking is guaranteed, and no card number is ever written down or recorded.

Collecting cards in customer support

When a payment fails or a card expires, support teams can send a link in the chat or ticket. The customer updates their card on a secure page, and the agent never sees it.

Card collection without a frontend

B2B platforms, back-office tools and messaging-based services often have no checkout at all. A link adds secure card collection without anyone having to build or maintain a payment form.

In-person and print

Shown as a QR code on a screen, an invoice or a check-in desk, a link lets customers enter their card on their own phone, without handing it to anyone.

Why Tokenization by Link matters for your business

The most visible benefit is scope. Because the card is entered on a page hosted by PCI Proxy and goes straight to the vault, it never passes through your systems, your agents or your communication tools. Phone systems, helpdesks and mailboxes no longer need to be treated as places where card data might turn up, as long as the team uses links instead of taking card numbers directly. That last point is a process change as much as a technical one: the API removes the need to handle card data, and your team policy makes sure nobody does it anyway.

The second benefit is trust. Customers are increasingly wary of reading their card number out loud or typing it into an email. A branded, secure page feels safer and more professional, and it fits naturally into how people already communicate with your business.

The third is speed. A link can be created and shared in seconds, without any development work per channel, and with 3D Secure built in where you need it. Once you have the token, you charge the card whenever it suits you, through the Forward Proxy and the payment provider of your choice.

Frequently asked questions

How long is a link valid?

A link stays valid until it's used, and it can be used only once. You can delete it at any time if it's no longer needed.

Does Tokenization by Link charge the card?

No. It collects and tokenizes the card. You charge it afterwards by sending the token to your payment provider.

Can customers use it on their phone?

Yes. The page works on any device with a browser, which is also what makes QR codes work so well.

Getting started

Tokenization by Link works with a single API call and needs no frontend of your own. For request details, status updates and styling options, see Tokenization by Link in our API documentation, or talk to the PCI Proxy team about rolling it out to your agents.