Channex and PCI Booking
Take the cards from your Channex bookings without touching them
Channex releases guest and virtual cards only to parties that are PCI DSS compliant, or that use a tokenisation provider it accepts. PCI Booking is one of the three providers Channex names. The cards come to us, your PMS or booking platform keeps a token, and we hand Channex the documents it asks for.
Listed in the Channex PCI guide · PCI DSS Level 1 service provider · Free sandbox and support
Level 1
PCI DSS service provider
ISO 27001
Certified to ISO 27001:2022
120+
Payment integrations, one API
10M+
Card operations a month
Why you are here
Channex will not send you the card until you are covered
Your bookings from Booking.com, Expedia and the other OTAs arrive through Channex with a guest card or a virtual card attached. By default you see a masked number. To get the full card, Channex needs one of two things from you.
Option A: your own PCI DSS attestation
Channex asks for an SAQ D (Service Provider) Attestation of Compliance, Level 1 or Level 2, dated within the last 12 months. That means your PMS stores, processes and transmits card data, and you carry the audit every year.
Option B: a tokenisation provider Channex accepts
Channex names three providers in its PCI guide, and PCI Booking is one of them. Channex takes the provider's AOC instead of yours. The card never reaches your servers, so your own PCI DSS scope shrinks to a short self-assessment.
What PCI Booking adds
The same token works everywhere. Show the card to hotel staff, charge it through the hotel's own payment provider, forward it to another system, or keep it for a later no-show fee. One vault for Channex cards, your booking engine and any other source.
Source: Channex, Guide to PCI and the Bookings API.
How it fits together
Channex sends the card. Your system gets a token.
Your platform fetches bookings from the Channex secure endpoint exactly as it does today, but the call goes through PCI Booking. We take the card out of the response, store it, and pass the booking on to you with a token in its place.
1. Tokenize on the way in
Point your Channex booking calls at PCI Booking instead of calling Channex directly. We forward the request to the Channex secure endpoint, capture the card in the response, and return the booking to you with a token. Nothing changes on the Channex side except the allow-list.
2. One token for the whole card
Number, expiry, cardholder and card type, with the CVV kept as long as your rules allow. A virtual card is treated like any other card, and the virtual-card details Channex sends with the booking come back to you in the response as before. If the same card arrives twice, you can ask for the existing token back.
3. Use the token where you need it
Show the card to authorised hotel staff in a secure frame, charge it through the hotel's own payment provider, send it to the hotel's PMS in its format, or keep it on file for a no-show fee. Same token, every path.
What about the Channex PCI app? Channex offers its own app for viewing a card on a booking, with two-factor authentication. It covers one need: a person looking at one card inside the Channex interface. It does not give your PMS a token, charge the card, or deliver it to a hotel system. PCI Booking covers the viewing need too: hotel staff open the card in our secure frame inside your own system, behind a one-time password. One system does it all: receive, store, show, charge, forward.
What you can do once the card is in the vault
Everything the teams who write to us ask for
These are the requests we see from Channex-connected PMS, booking engine and vacation-rental platforms, and the PCI Booking capability that answers each.
Show the card to hotel staff
An iframe inside your extranet shows the full card to users you authorise, behind a one-time password. Staff can key it into their own terminal. Your back office never holds the number.
Charge through the hotel's own PSP
One API, 120+ payment integrations. A token for a card received from Channex can be sent to any of them. If a provider your hotels use is not on the list, we add it on demand at no additional cost: request an integration. Each hotel's merchant credentials sit in your account, and you name the right one on each charge, pre-authorisation, capture or refund.
Take cards in your own booking engine
A hosted card form for direct bookings and online check-in, in your branding. The guest types the card into our frame, you get the same kind of token as a Channex card, and your pages stay out of scope.
Forward the card to another system
Send the card on to a hotel's PMS, a payment API such as a local acquirer, or a partner, in JSON, XML or form parameters, with the card number inserted in transit. Your servers build the request around the token.
Keep the card for later, then delete it
Hold the card for a no-show fee or a deposit after departure. Delete it when the stay is over, with one call from your own scheduler. The CVV follows its own rule: kept until your authorisation process completes, within a ceiling you choose.
Many hotels, one account
A PMS or platform opens one account and serves every property on it. Each property's payment provider credentials are stored under that account, and each charge names the property it belongs to.
Step by step
From first contact to live Channex cards
Seven steps. Most teams finish the build in a few weeks; the Channex approval at the end usually takes a few working days. Support is free throughout the build.
Step 1 · You
Request a free sandbox
Fill in the sandbox request form: your name, company, email and phone number. That is all we need at this stage.
The sandbox is a full copy of production, with mock partners and test cards. It is free, and so is the support while you build.
Step 2 · PCI Booking
We send you the sandbox details and the API docs
We open your sandbox account and email you the details: your sandbox API keys, a login to the portal and the developer documentation. The documentation has a page that explains what to set up in PCI Booking to work with Channex: Receiving cards from Channex.
Step 3 · You
Point your existing Channex request at PCI Booking
Take the request your platform already sends to Channex to fetch a booking. Replace the Channex URL with the PCI Booking Channex URL given in the guide, keep your Channex API key header as it is, and pass the booking ID as before. We call Channex for you and return the same response, with the card replaced by a token.
Step 4 · You
Add the features your hotels need
With the Channex cards in the vault, extend your use of PCI Booking as far as you want: embed card forms in your own booking pages, process charges through each hotel's payment provider, run 3D Secure, display cards to hotel staff, keep cards on file for later charges, and more. Each is in the same documentation, against the same token.
Step 5 · You and PCI Booking sales
Agree the commercials and open your live account
Talk to sales about your volume and the flows you use. Sales drafts the Master Services Agreement, you sign it, and we set up your live PCI Booking account and production keys. Your sandbox stays open.
Step 6 · You, with documents from PCI Booking
Send Channex the PCI Booking documents
Write to support@channex.io from the email on your Channex account and ask to switch your production integration to the secure endpoint. Channex needs two things from PCI Booking:
- Our PCI DSS Attestation of Compliance. Request it from us and attach it.
- Our IP addresses, for the Channex allow-list. They are published in the docs: Outbound IP addresses.*
* PCI Booking already has customers connected to Channex, so Channex most likely has our IP addresses approved already. Include them in your request anyway.
Step 7 · You
Point production at the live endpoints and go
Switch your Channex target from staging to secure.channex.io and your PCI Booking calls to your production keys. From the next booking on, cards land in the vault and your platform holds tokens. Support stays with you after go-live.
What Channex needs from you
The document pack we give you for Channex
Channex's PCI guide says it needs the tokenisation provider's AOC. Its API documentation adds an IP allow-list for the secure endpoint. We provide both, plus two optional items that speed up the review.
Required by Channex
- PCI DSS Attestation of Compliance: PCI Booking's current AOC as a Level 1 service provider, assessed by a QSA and dated within the last 12 months. Channex accepts the provider's AOC in place of your own.
- IP address list: The fixed addresses PCI Booking calls Channex from. Channex adds them to the allow-list for your account's secure endpoint.
- Your request email: Sent by you, from your Channex account, naming PCI Booking as the party that receives card data on your behalf. We give you a short template.
Optional, often asked for
- ISO/IEC 27001:2022 certificate: Certificate number 527616, issued by Amtivo Ireland, valid to 12 February 2028. Useful when the review passes through a security team.
- One-page flow description: A short description of how card data moves between Channex, PCI Booking and your platform, for Channex's records and for your own PCI self-assessment.
- Data processing agreement: Part of our standard agreement, for customers who need it for the GDPR.
Your PCI DSS position afterwards
What stays with you, what moves to us
| Item | Today, and what it costs you | With PCI Booking, and what you gain |
|---|---|---|
| Full card numbers from Channex | Stored in your PMS database. Your database, backups and every admin who can read them are in PCI DSS scope. | Stored in the PCI Booking vault; you keep a token. A breach of your database exposes no card numbers. The token is useless outside your account. |
| Cards typed in your booking engine | Pass through your web servers. Every server, log and library on that path has to be hardened and evidenced each year. | Typed into our hosted frame; you keep a token. Your pages never see the number. The frame carries your branding and languages. |
| Showing a card to hotel staff | Rendered by your application. You build and audit the access control and two-factor authentication yourself. | Rendered in our frame behind a one-time password. The access control comes with it. Staff key the card into their own terminal. |
| Charging a card | Your code sends the card to the PSP. One integration per payment provider, each one in scope, each one yours to maintain. | Your code sends the token to us; we send the card to the PSP. One API for 120+ integrations. Each hotel charges through its own account, and a new provider costs you nothing. |
| Annual PCI DSS work | SAQ D, often with a QSA. The longest self-assessment there is, and a cost that returns every year whether or not you grow. | A shorter self-assessment covering what is left in your systems. Less to evidence, less to pay for, and the same answer whether you serve ten hotels or a thousand. |
| Document Channex holds | Your own AOC, renewed yearly. Miss the renewal and Channex stops sending cards. | PCI Booking's AOC. We renew it. Channex accepts it in place of yours. |
PCI Booking keeps card data out of your systems, which reduces your PCI DSS scope and simplifies your annual audit. What remains in scope depends on your own setup; the guide and our support team help you work it out.
FAQ
Questions Channex-connected teams ask us
Do you already have a working integration with Channex?
Yes. Channex-connected PMS and booking platforms receive their OTA cards through PCI Booking today, and Channex names PCI Booking in its PCI guide as one of the tokenisation providers it accepts. The setup on your side is the booking request described above, plus the documents Channex asks for.
Does Channex push the card to you, or do we pull it through you?
You pull it through us. Channex never pushes the card: its booking webhook carries only identifiers, and your platform then fetches the booking from the Channex API. That fetch goes through PCI Booking, and we tokenise the response.
Are virtual cards from Booking.com and Expedia handled the same way?
Yes. A virtual card is a card. It is tokenised, stored, shown and charged like any other, and the virtual-card details Channex sends with the booking (balance, currency, activation and expiry dates) come back to you in the booking response as they do today.
Do we still need our own PCI DSS attestation?
Not for Channex. Channex accepts the tokenisation provider's AOC, and we provide ours. You still complete a self-assessment for whatever card handling is left in your systems; with the card never reaching your servers, it is a much shorter one.
Can each hotel charge through its own payment provider and merchant account?
Yes. Store each property's credentials under your account and name the right ones on each transaction. One API covers 120+ integrations, and a Channex card token can be charged through any of them. If a provider you need is not on the list, we add it on demand at no additional cost: request an integration.
Can hotel staff see the CVV to key a charge into their own terminal?
Yes, while your CVV rule allows it. PCI DSS does not permit keeping the CVV once the card has been authorised, so each account defines when that point is reached, within a retention ceiling you set. Until then the CVV shows in the card-show frame alongside the number.
Can you forward the card to our acquirer's API if it is not on your gateway list?
Yes. The proxy sends a request you build to any HTTPS endpoint you register with us, inserting the card number in transit. Each hotel's credentials travel in the request you construct, so your servers never see the card.
How long does the whole thing take?
One of our team gets in touch within one business day of your sandbox request. Most teams build and test in two to four weeks, depending on how many of the flows above they use. Channex activates the secure endpoint a few working days after it receives the documents.
What does it cost?
You pay per card operation: tokenizing, sending, showing or charging a card, with volume discounts. The sandbox and support during the build are free, and you pay only when you go live. See the pricing page, or tell us your monthly card volume for a quote.
Related: Receiving cards from Channex (developer guide) · Channel managers and distribution · PMS and hotel tech
Tell us about your Channex setup
Request the sandbox and you can start building this week. Talk to sales when you are ready to discuss the plan for your volume.
Channex is a trademark of its owner. PCI Booking is an independent provider listed in the Channex PCI guide.