Tokenizations Now Automatically Deactivated on Card Closure

Overview

Lithic now automatically deactivates all active tokenizations associated with a card when that card is permanently closed. Customers no longer need to call the deactivate tokenization endpoint for each tokenization after closing a card. Tokenizations on cards being replaced stay active, so cardholders' digital wallets, such as Apple Pay and Google Pay, continue to work with the replacement card.

Details

Previously, closing a card did not change the state of its tokenizations. Tokenizations remained ACTIVE on the network until the customer or the network deactivated them individually. This left live tokens on cardholder devices and with merchants for cards that could no longer transact.

With this change, Lithic deactivates a card's tokenizations when:

• The card is closed and not being replaced, for example via PATCH /v1/cards/{card_token} with state: CLOSED.
• The card is replaced with a replacement_substatus of COMPROMISED or SUSPICIOUS_ACTIVITY. These are the same replacements for which Lithic withholds the new card details from Mastercard's Automatic Billing Updater (ABU) and Visa's Account Updater (VAU).

Lithic does not deactivate tokenizations when a card is replaced with any other replacement_substatus, or with no substatus provided. In these cases, the replacement card details are sent to ABU and VAU, and the card's tokenizations stay active so cardholders can keep using their digital wallets without re-provisioning.

When a tokenization is deactivated, Lithic sends a deactivation request to the card network. Once the network confirms, the tokenization's status changes to DEACTIVATED and a tokenization.updated event is sent. Deactivation happens asynchronously, so cards with many tokenizations may take a few seconds to finish.

Renewing (POST /v1/cards/{card_token}/renew) or reissuing (POST /v1/cards/{card_token}/reissue) a card does not close it, so these actions do not affect its tokenizations.

Card Replacements

Replacing a card with POST /v1/cards and replacement_for closes the original card, but Lithic does not deactivate that card's tokenizations. Cardholders typically expect digital wallets like Apple Pay and Google Pay to keep working when their card is replaced, so these tokenizations remain active and continue working with the replacement card.

If you want a replaced card's tokenizations deactivated, for example when a cardholder reports their device lost or stolen, use the Deactivate a card tokenization endpoint.

Renewing (POST /v1/cards/{card_token}/renew) or reissuing (POST /v1/cards/{card_token}/reissue) a card does not close it, so these actions do not affect its tokenizations.

Release Timeline

Production availability: Available now

User Impact

Existing integrations will continue to function without modification. If your integration already deactivates tokenizations after closing a card, you can keep doing so. Tokenizations that are already DEACTIVATED are skipped, and you may choose to remove that logic. If you listen for tokenization.updated events, expect to receive them for each tokenization deactivated by a card closure.

Updated Documentation

For more on card replacement, visit our Managing Cards guide. For tokenization endpoints and events, see our API Reference for Deactivate a card tokenization and tokenization.updated.

If you have any questions or concerns, please contact us via the HELP link in your Lithic Dashboard.

The Lithic changelog has an RSS feed! To monitor for new update announcements, subscribe with your preferred RSS reader.