Tokenization is a security process that replaces sensitive payment data, such as card numbers or bank account details with a randomly generated, non-sensitive identifier called a token. The token can be used to process future transactions without exposing the underlying payment credentials, keeping sensitive data out of merchant systems and reducing PCI compliance scope.

When a customer submits payment details, the gateway captures the data and exchanges it for a token—a random identifier that represents the payment method. The merchant's systems store and use only the token, never the raw account data. Even if intercepted, the token is useless to attackers beyond a short validity window.

Forte.js generates a one-time token at the moment of form submission, which can then be exchanged via REST API for a permanent payment method token stored in a PCI-compliant vault. This permanent token enables recurring billing, one-click payments, and stored credentials without the merchant ever handling raw card or bank account numbers directly.

One-time tokens are created at the point of payment capture and expire after 60 minutes or one use, whichever comes first. They can be exchanged for permanent payment method tokens, which are stored in a PCI DSS-compliant vault and linked to a customer profile for ongoing use in recurring billing or future transactions.

The available documentation does not explicitly address token portability when switching processors. Tokens are stored in a proprietary PCI-compliant vault and are designed for use within the platform's ecosystem. For specific guidance on token portability or migration scenarios, it is recommended to consult directly with the payments team to understand available options.