Freedom251 › Payment Tokenization Software

Worldpay eProtect

Paid AndroidAPIiPhoneWeb

What Worldpay eProtect is

Worldpay eProtect is a cloud service for card-not-present payments that replaces card details with a low-value Registration ID. Worldpay can exchange that ID for an OmniToken during authorization, a sale, or token registration; the token may then be used for card-on-file transactions, returns, and recurring billing. Merchants can integrate through a hosted iFrame, the JavaScript Customer Browser API, or a Mobile API. The iFrame hosts card number, expiration, and CVV2 fields in Worldpay’s PCI-compliant environment. The JavaScript option validates and encrypts the account number before sending it to Worldpay.

Worldpay says card data does not pass through the merchant’s web server and that eProtect reduces applicable PCI controls. The guide includes support sections for Apple Pay, Apple Pay on the Web, Google Pay, and Visa Checkout. Before production, an organization must be enabled and certified to process OmniTokens, obtain a PayPage ID, and complete certification testing. The token exchange does not check CVV or AVS information and does not validate expiration dates. Pricing is available on request.

Who it suits

eProtect may suit organizations handling card-not-present payments that can meet its OmniToken onboarding and certification requirements. Its integration options include hosted web fields, a JavaScript API, and a Mobile API.

What it does well

Three listed integration options.
OmniTokens may support recurring billing and returns.
Card data does not pass through the merchant web server.
Guide includes wallet integration sections.

What to know first

Requires OmniToken enablement and certification.
Requires a PayPage ID before use.
Token exchange does not validate CVV, AVS, or expiration.

Limits

Before production, an organization must be enabled and certified to process OmniTokens, obtain a PayPage ID, and pass certification testing. Token exchange does not validate CVV, AVS, or expiration dates.

Getting started

Review the eProtect integration guide.
Choose an iFrame, JavaScript Customer Browser API, or Mobile API integration.
Arrange OmniToken enablement and certification with Worldpay.
Obtain a PayPage ID from an eProtect Implementation Consultant.
Complete eProtect certification testing before production use.

Verdict

eProtect provides several ways to integrate tokenized card handling for card-not-present payments. Organizations should account for its onboarding requirements and the validation checks it does not perform.

Questions

How is eProtect priced?

Pricing is available on request.

Which integration options does eProtect offer?

The guide describes iFrame, JavaScript Customer Browser API, and Mobile API integrations.

What must an organization do before production use?

It must be enabled and certified to process OmniTokens, obtain a PayPage ID from an eProtect Implementation Consultant, and complete successful certification testing.

Does eProtect validate CVV, AVS, and expiration dates?

No. The guide says token exchange does not check CVV or AVS information and does not validate expiration dates.

Which payment wallets are covered?

The guide includes support sections for Apple Pay, Apple Pay on the Web, Google Pay, and Visa Checkout.

Where is eProtect hosted?

It is a cloud deployment with vendor-hosted token vaulting.

Facts from Worldpay eProtect's own pages

Accessibility: The guide says iFrame version 4 improves screen-reader accessibility for expiration fields and error messages; version 3 lacks those upgrades. · docs.worldpay.com, 7 Oct 2026
Availability: Worldpay says primary and secondary endpoint routing supports high availability for eProtect JavaScript API version 3 or higher. · docs.worldpay.com, 7 Oct 2026
Card data handling: The guide states that card data is not transmitted through the merchant web server and that the token server stores the card number but not CVV or expiration date. · docs.worldpay.com, 7 Oct 2026
Certification: The guide says successful eProtect certification testing is required before production use. · docs.worldpay.com, 7 Oct 2026
Checkout features: The iFrame offers real-time inline field validation, configurable payment-form behaviors, and account-number auto-formatting based on card type. · docs.worldpay.com, 7 Oct 2026
Company headquarters: Worldpay states that it is headquartered in Cincinnati, Ohio, United States. · privacy.worldpay.com, 7 Oct 2026
Follow-on payments: The guide says an OmniToken may be used for card-on-file transactions, returns, and recurring billing. · docs.worldpay.com, 7 Oct 2026
Hosted card fields: With the iFrame API, payment card fields are hosted from Worldpay’s PCI-compliance environment instead of being embedded in the merchant checkout page. · docs.worldpay.com, 7 Oct 2026
iFrame fields: The iFrame API hosts sensitive payment fields, including card number, expiration date, and CVV2, in Worldpay’s PCI-compliant environment. · docs.worldpay.com, 7 Oct 2026
Integration methods: The guide describes iFrame API, JavaScript Customer Browser API, and Mobile API integrations. · docs.worldpay.com, 7 Oct 2026
Integration options: The guide describes iFrame, JavaScript Customer Browser API, and Mobile API integration options. · docs.worldpay.com, 7 Oct 2026
JavaScript handling: The JavaScript API validates and encrypts the account number before sending it to Worldpay and returns a Registration ID in its place. · docs.worldpay.com, 7 Oct 2026
Onboarding requirement: Before using eProtect, an organization must be enabled and certified to process OmniTokens and obtain a PayPage ID from its eProtect Implementation Consultant. · docs.worldpay.com, 7 Oct 2026
Payment methods: The guide includes integration instructions for Apple Pay on the Web, Google Pay, and Visa Checkout. · docs.worldpay.com, 7 Oct 2026
Payment types: The eProtect PCI Non-Sensitive feature can tokenize private-label and Worldpay gift cards, subject to the Worldpay message interface specification. · docs.worldpay.com, 7 Oct 2026
Prerequisites: Before using eProtect, an organization must be enabled and certified to process OmniTokens and obtain a PayPage ID from its eProtect Implementation Consultant. · docs.worldpay.com, 7 Oct 2026
Purpose: eProtect is designed for card-not-present payments and reduces the amount of payment data in a merchant’s systems. · docs.worldpay.com, 7 Oct 2026
Security and PCI: Worldpay says no card data is transmitted through the merchant’s web server and that eProtect reduces applicable PCI controls. · docs.worldpay.com, 7 Oct 2026
Support: The guide lists 24/7 technical support for critical production issues and says technical support representatives respond to eCommerce technical issues within 15 minutes. · docs.worldpay.com, 7 Oct 2026
Token flow: eProtect returns a low-value Registration ID, which Worldpay can exchange for an OmniToken during authorization, sale, or token registration. · docs.worldpay.com, 7 Oct 2026
Tokenization: It exchanges card details for a low-value Registration ID, which is exchanged for a Worldpay token during a transaction. · docs.worldpay.com, 7 Oct 2026
Token use: The guide says the resulting OmniToken can be used for follow-on transactions such as card-on-file, returns, and recurring billing. · docs.worldpay.com, 7 Oct 2026
Validation limit: The guide states that eProtect’s token exchange does not check CVV or AVS information and does not validate expiration dates. · docs.worldpay.com, 7 Oct 2026
Wallets: The guide includes eProtect support sections for Apple Pay, Apple Pay on the Web, Google Pay, and Visa Checkout. · docs.worldpay.com, 7 Oct 2026

Where Worldpay eProtect stands on Freedom251

Payment Tokenization Software#17 of 22