How it works
How PCI Booking works
Cards come in from guests, OTAs, channel managers and other partners and become one token. Your systems keep the token; we keep the card. When you need the card, send the token and tell us what to do with it.
PCI DSS Level 1 · 120+ integrations · Free design and implementation support
The three steps
Cards in, cards stored, cards out
Each step works on its own. Most customers use all three.
Step 1
Cards in
Every route a card can take ends at our vault: a form on your site, a payment link, a partner's API, a file or an upload from another provider. Your systems receive a token instead.
Cards from partners by API or HTTP
We tokenize cards in the messages partners send you (on request) or in the responses you pull from them (on response).
Any format, their encryption
JSON, XML, plain text or URL parameters, with each partner's own encryption and message signing. Ready-made profiles for the major OTAs, channel managers and GDSs.
Files by SFTP
Partners push files to us or we pull them. Card details are replaced with tokens before the file reaches you.
Hosted card form
In your page as an iframe, with 3D Secure. The same form opens on its own page from a card link.
Link by email or SMS
For bookings taken by phone or by an agent. The guest enters the card in a secure form.
Upload from another provider
Bring the cards you already hold into the vault when you switch to us.
Payments Library
Wallets, PayPal, open banking and UPI alongside cards.
Step 2
Cards stored
The card stays in our PCI DSS Level 1 vault. Your system keeps one token for the whole card, number, CVV, expiry and 3D Secure result, and uses it whenever the card is needed.
One token for the whole card
Number, CVV, expiry and the 3D Secure result in a single token, the same however the card arrived.
PCI DSS Level 1 vault
Card data is stored with us, in the region you choose, in an environment assessed every year.
Token management by API
Create, look up and delete tokens from your own systems.
Group cards your way
Group cards by your own customer, merchant or reference.
3D Secure data with the token
Authentication results are kept with the card, so a later charge can carry them.
Network tokens
Visa, Mastercard and Amex network tokens keep cards current when they are reissued.
Any data, not only cards
Tokenize other sensitive fields in the same way.
Step 3
Cards out
When you need the card, send the token and say what to do with it. We charge it through a payment provider, pass it to a partner's system, show it to your staff, put it in a file, or share it with another PCI Booking customer by token.
One API for payments
Charge, pre-authorize, capture, refund or void through any of 120+ integrations.
Each merchant on its own provider
Every merchant charges through its own payment provider account, and you manage all the accounts in one place.
Fallback to backup accounts
If a charge fails, we retry it on your backup accounts, in the order you set. Declines a retry cannot fix, such as an expired or stolen card, are not retried.
Forward in the right format
Send the card to a hotel, supplier or partner system you have approved, in the format it expects, by API or to its SFTP server.
Display to authorised people
Staff and agents view the card in a secure form, without it entering your systems.
Virtual cards for suppliers
Issue virtual cards through your own provider to pay suppliers. Each new card is stored as a token, ready to send.
Share cards with partners
Share a card with a partner that also uses PCI Booking, by token, with no card number passed.
For developers
Send a token, get a charge result
One request to charge a stored card through a payment provider, and the result that comes back.
Request
curl -X POST "https://service.pcibooking.net/api/paymentGateway?credentialsId=my-stripe-prod" \
-H "Authorization: APIKEY YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"cardToken": "https://service.pcibooking.net/api/payments/paycard/555fd7b49f134b42a5dbe4d576b2e527",
"OperationType": "Charge",
"Amount": 150.00,
"Currency": "USD",
"myRef": "order-98765"
}'From the developer docs: Process transaction, request example
Response
{
"OperationType": "Charge",
"OperationResultCode": "Success",
"OperationResultDescription": "Order 98765",
"GatewayName": "Stripe",
"GatewayReference": "ch_3PqL2x2eZvKYlo2C0b1a2b3c",
"GatewayResultCode": "succeeded",
"GatewayResultDescription": "Order 98765",
"GatewayResultSubCode": null,
"GatewayResultSubDescription": null,
"AuthorizationCode": "",
"Currency": "USD",
"Amount": 150.00
}From the developer docs: Process transaction, 200 Success
Controls
You decide who can use a card, and where it can go
Access to cards is limited to the people, systems and destinations you approve.
Sub-users and API keys
Give each person and each system its own access, and remove it when it is no longer needed.
IP restrictions
Accept requests only from the addresses you list.
Whitelisted destination URLs
Cards can only be sent to destinations you have approved.
OTP contact verification
People who view a card confirm who they are with a one-time password.
Getting started
Build against a free sandbox. Pay when you go live.
A free sandbox, by request
A copy of production to build and test against. We set it up with you.
Free support through the build
A solutions engineer designs the integration with you and answers questions while you build.
FAQ
Common questions
Is PCI Booking the same as PCI Shield?
PCI Booking was formerly known as PCI Shield. Same product, one name.
Do my systems ever see card numbers?
Cards reach us directly from the hosted form, the card link or your partners, and your systems receive a token in their place. When a card needs to be charged, shown or forwarded, you send us the token and we do it, so the card number does not pass through your systems.
Do my partners have to change anything?
No. Partners keep sending cards from their own systems, in their own formats and with their own encryption. We capture the cards on the way in. Ready-made profiles cover the major OTAs, channel managers and GDSs.
Can I use my own payment provider?
Yes. You, or each of your merchants, charge through your own payment provider accounts, across 120+ integrations with one API. If yours is not on the list, tell us and we will add it, free. Charge through any PSP
Tell us where your cards come from and where they need to go
A solutions engineer reviews your card flows with you and shows you what the integration looks like.