Cashfree Payment Gateway - Token Vault (RBI Card Tokenization)

Set save_instrument: true in the Order Pay call when the customer enters card details the first time. Cashfree then performs asynchronous network tokenization, and you must wait for the INSTRUMENT_ACTIVE_WEBHOOK before showing the card as saved.

Create an order as usual, then call PGPayOrder with payment_method.card.instrument_id set to the saved instrument instead of raw card details. CVV may be required on first reuse depending on network policy, and 3DS challenges are handled like normal card payments.

No. Since October 2022, RBI prohibits merchants and payment aggregators from storing raw PAN, CVV, or expiry data. Merchants must use network tokens issued by Visa, Mastercard, or RuPay through a token vault like Cashfree's.

Tokenization is asynchronous, so the instrument is not usable immediately after payment. Wait for the INSTRUMENT_ACTIVE_WEBHOOK before listing it; if you receive INSTRUMENT_FAILED_WEBHOOK, the issuer rejected tokenization and the customer must re-enter the card.

No. RBI tokenization applies to Indian-issued cards only; foreign-issued cards are not supported through this token vault. Amex and Diners have limited support, so fall back to a non-saved flow when tokenization fails.

Call DELETE /pg/customers/{customer_id}/instruments/{instrument_id} to remove the instrument, which satisfies RBI and DPDP deletion requirements. Refunds on prior transactions still work because they route to the underlying card through the network.