5 Payment Gateways for Secure Saved Card Payments in India (2026): Tokenisation Compared

If customers buy from you more than once, a saved card shortens checkout. But saved card payments in India have worked differently since the RBI tokenisation rules: merchants and gateways can no longer keep card numbers. They keep tokens, and your gateway decides how well that works.

This guide explains card tokenisation under the RBI framework, what data your business receives, and how Razorpay, Cashfree, PayU, PhonePe Payment Gateway and CCAvenue compare on documented features. Documentation and pricing pages were checked in October 2026.

Quick answer: For saved card payments in India, choose a gateway that acts as an RBI-compliant token requestor, documents its supported card networks, gives you APIs to fetch and delete tokens, exposes token status, and explains whether its tokens work with other gateways. On those criteria, Razorpay’s TokenHQ has the most complete public documentation, with Cashfree and PayU close behind.

How do saved card payments work under RBI rules?

The Reserve Bank of India’s circular of 7 September 2021 extended tokenisation to cards saved with merchants for repeat purchases. It also said that no entity in the card payment chain, other than card issuers and card networks, should store actual card data. The RBI card-on-file tokenisation circular sets four rules that matter most to merchants:

• A card is tokenised only with the customer’s explicit consent, validated by the issuer through an additional factor of authentication (AFA), usually an OTP.
• Each token is unique to a combination of card, token requestor and merchant, so it cannot be used on another merchant’s site.
• The merchant must give the cardholder an option to de-register the token.
• Entities may keep the last four digits of the card number and the issuer’s name.

Network tokens vs card-on-file tokenisation

Card-on-file tokenisation (CoFT) is the use case: saving a card with a merchant for repeat payments. A network token is one way to deliver it, issued by the card network’s token service. The 2021 circular also let issuers act as token service providers for their own cards, so a bank can issue an issuer token. Razorpay’s dual token documentation notes that network tokens are interoperable across processors, while issuer tokens are not.

Your gateway then gives you its own reference ID (a Razorpay token ID, a Cashfree instrument ID or a PayU card token), which is what your systems store. Device tokenisation, where the token is tied to the customer’s phone rather than a merchant, is a separate model. For a deeper comparison of the two token types, read our explainer on network tokens vs PCI tokens.

The saved card checkout flow, step by step

This is the merchant-side data flow when the gateway acts as token requestor:

1. The customer enters card details at checkout and chooses to save the card. This is the consent step.
2. The issuer authenticates the customer, usually by OTP, and the first payment is processed. Cashfree and PhonePe both document that tokens are created only after a successful transaction.
3. The gateway asks the card network or issuer for a token bound to that card, that requestor and your business.
4. The gateway stores the token. Your server receives a reference ID and display data, never the full card number.
5. On a repeat visit, the gateway identifies the customer (by customer ID, mobile number or login) and lists saved cards by network and last four digits.
6. The customer picks a card. The gateway sends the token with a transaction-specific cryptogram to the network, which maps it to the real card for the issuer.
7. The issuer applies its usual checks and approves or declines.
8. The customer can delete the saved card at checkout or through their bank, and you can delete it through the gateway’s API.

PCI DSS compliant businesses can sometimes act as token requestor themselves. Razorpay offers this on demand, subject to its approval.

What data does the merchant see?

You never see the card number or CVV. Based on each provider’s API documentation, you do receive:

• Razorpay: last four digits, network, issuer code, card type, an international flag, EMI eligibility, expiry and token status.
• Cashfree: last four digits, network, issuing bank, issuing country, card type and sub-type, plus token expiry.
• PayU: a masked card number showing the last four digits, the network, the issuing bank and a card token.
• PhonePe Payment Gateway: token ID, last four digits, expiry, token type, token issuer and lifecycle status.

One detail catches support teams out. Razorpay notes that for network-tokenised cards, the payment record shows the last four digits of the token, not of the actual card, so a customer’s quoted digits may not match your records.

Tokens protect the card number, not the customer’s account on your site. Anyone who takes over that account sees the saved cards listed there. Our guide to detecting and stopping account takeover attacks covers the main controls.

Why saving a card does not authorise recurring debits

A saved card lets the customer pay faster when they choose to. It does not let you charge them on a schedule. Under RBI’s E-mandate Framework, 2026, a mandate is registered only after AFA validation, the issuer sends a pre-debit notification at least 24 hours before each charge, and the cardholder can opt out or withdraw the mandate online. Treat subscriptions as a separate flow; our guide to securing recurring billing and subscriptions covers that side.

Token lifecycle: creation, deletion, status and portability

Tokens can be suspended, expire or be deleted, so your checkout must handle each state. Razorpay’s tokenisation APIs document fetch and delete calls and statuses of initiated, active, suspended and deactivated (with reasons such as expired or deactivated by the bank). Deleting a Razorpay token applies across all your merchant IDs. Cashfree’s delete API marks the instrument inactive, and PayU documents save, get, edit and delete calls.

Customers have their own routes. RBI requires issuers to let cardholders view where their card is tokenised and de-register tokens through channels such as mobile banking or IVR. Razorpay also runs a portal where shoppers delete saved cards.

Portability vs interoperability

Cashfree’s documentation states the distinction clearly. Tokens are not portable: one provider’s token cannot be moved into another provider’s vault. They can be interoperable: another aggregator can process the token if the original requestor supplies the cryptogram. Razorpay says its tokens can be processed on external gateways through Optimizer, and PCI DSS compliant businesses can fetch the network token and cryptogram for any aggregator. CCAvenue makes a similar claim for PCI DSS compliant businesses.

Card tokenisation payment gateway comparison

We used five criteria, based only on public documentation: supported networks, requestor models, token management APIs, customer deletion options and cross-gateway use. “Not publicly documented” does not mean unavailable; confirm with the provider.

The five gateways profiled

1. Razorpay (TokenHQ)

Razorpay leads on our criteria because it publishes the most complete token documentation: three requestor models, fetch and delete APIs, explicit status values and a customer deletion portal. On Standard Checkout, customers choose whether to save a card and verify by OTP. Razorpay’s saved cards documentation says enabling tokenisation can take 5 to 7 working days for some networks, and its Optimizer tokenisation guide covers multi-gateway use. If you only need a basic hosted saved card option, much of this will go unused.

2. Cashfree (Token Vault)

Cashfree’s Token Vault documentation lists five networks and gives the clearest public explanation of portability. Its delete API returns detailed card metadata, and it says saved cards do not need CVV. It is a good fit for businesses already on Cashfree that want straightforward saved cards.

3. PayU (Token Hub and PayU Vault)

PayU documents three integration models (hosted checkout, zero code change and REST API), supports network and issuer tokens, and can return a cryptogram for a PayU or network token. It suits teams that want to choose their integration depth.

4. PhonePe Payment Gateway

PhonePe’s saved cards run on its Hosted Checkout through CoFT, with the PhonePe app as token requestor. Customers must be logged in, and that login is shared across merchants in the same browser. Its Bolt feature, announced in January 2026, uses device tokenisation for Visa and Mastercard so customers can tokenise once in the PhonePe app and skip CVV on the same device. Public token API documentation is limited.

5. CCAvenue (TokenPay)

TokenPay is a multi-network token requestor. CCAvenue is the only one of the five that publishes token charges: Rs 20,000 one-time setup, Rs 1.25 per token provisioning, migration or deletion, and Rs 0.20 per cryptogram, plus taxes. The page also mentions a setup fee waiver that ended in March 2022, so confirm current charges. It suits larger merchants wanting a token service separate from their acquirer.

Which gateway should you pick for saved card payments in India?

Pick Razorpay if you want documented control over token states and deletion, may run more than one gateway, or may become a PCI DSS token requestor. Cashfree suits existing Cashfree merchants, PayU suits teams wanting a choice of integration models, PhonePe Payment Gateway is worth testing if your customers use the PhonePe app, and CCAvenue fits a separately priced token service. Test deletion and expired-token flows before launch.

FAQs

1. Does the customer need to enter CVV for a saved card?

It depends on the gateway and the issuer. Razorpay’s API documentation says CVV is not required by default for tokenised cards and recommends removing the CVV field, though its Standard Checkout flow still describes customers entering CVV. Cashfree says saved cards do not need CVV, while PayU notes some banks may still ask for it.

2. How do refunds work on tokenised card payments?

Refunds go back to the card used for the payment. Razorpay says normal refunds take 5 to 7 working days and tokenisation does not affect them. Instant refunds carry a fee, and Razorpay’s tokenisation FAQ says instant refunds on tokenised cards are supported for Visa debit cards only. Check current availability before promising instant refunds.

3. Can a customer delete a saved card?

Yes. RBI requires merchants to offer a way to de-register a token, and issuers must let cardholders view and remove tokens through channels such as mobile or internet banking. Razorpay also runs a customer portal for this. Merchants can delete tokens through the APIs Razorpay, Cashfree and PayU document.

4. Is saving a card mandatory for customers?

No. Tokenisation needs the customer’s explicit consent, confirmed through an additional factor of authentication. Customers who skip the save option can still pay by entering card details each time. Your checkout should show the save option clearly and never pre-select consent.

5. Can a PCI DSS compliant business store card numbers?

No. The RBI rule applies to every entity other than card issuers and networks, whatever its PCI DSS status. What compliance can allow is acting as a token requestor yourself. Razorpay offers this on approval and lets compliant businesses fetch the network token and cryptogram to process through other aggregators.

6. Can I charge a saved card for a subscription?

Not on the strength of the saved card alone. Recurring card charges need an e-mandate registered with AFA, a pre-debit notification at least 24 hours before each charge, and an option for the customer to opt out. Set mandates up through your gateway’s recurring payments product.