Worldpay eProtect

Worldpay eProtect is a cloud service for card-not-present payments that reduces how much payment data passes through a merchant’s systems. It replaces card details with a low-value Registration ID, which Worldpay can exchange for an OmniToken during authorization, a sale, or token registration. That token may support card-on-file transactions, returns, and recurring billing. Merchants can integrate through a hosted iFrame, JavaScript Customer Browser API, or Mobile API. The iFrame hosts card number, expiration date, and CVV2 fields in Worldpay’s PCI-compliant environment; the JavaScript option validates and encrypts the account number before sending it to Worldpay. Worldpay says card data does not pass through the merchant web server and that eProtect reduces applicable PCI controls. The guide covers Apple Pay, Apple Pay on the Web, Google Pay, and Visa Checkout. Before production use, organizations must be enabled and certified to process OmniTokens, obtain a PayPage ID, and complete certification testing. eProtect does not validate CVV or AVS information or expiration dates.

eProtect offers multiple integration paths and a token flow for card-not-present payments. Merchants should account for its enablement and certification requirements, along with the stated validation limits.

eProtect suits merchants handling card-not-present payments who want token-based payment flows and hosted or API integration options. It requires organizational enablement, a PayPage ID, and successful certification before production use.

Worldpay eProtect is a card-not-present payment tokenization service for merchants that want to reduce card-data exposure in their systems. It suits organizations already processing Worldpay OmniTokens and able to complete the required certification. Its range of web and mobile integration paths is useful, but onboarding and the limits of its validation make it a deliberate implementation choice rather than a drop-in checkout shortcut.

Overview

eProtect replaces card details with a low-value Registration ID, which Worldpay can exchange for an OmniToken during authorization, sale, or token registration. The token can support later card-on-file payments, returns, and recurring billing, giving merchants a way to handle repeat-payment workflows without keeping the card number in their own systems.

Worldpay says card data does not pass through the merchant web server. With the iFrame integration, sensitive fields—including card number, expiration date, and CVV2—are hosted in Worldpay’s PCI-compliant environment. The token server stores the card number, but not the CVV or expiration date. This can reduce applicable PCI controls, though it does not remove the need to meet eProtect’s enablement and certification requirements.

Key features

Three integration paths

Merchants can choose an iFrame API, JavaScript Customer Browser API, or Mobile API. The iFrame keeps sensitive fields outside the merchant checkout page and offers inline validation, configurable form behavior, and account-number formatting based on card type. JavaScript validates and encrypts the account number before sending it to Worldpay, returning a Registration ID instead. The choice is practical flexibility, but teams need to match an integration to their checkout and development needs.

Tokens, wallets, and payment types

OmniTokens can support card-on-file transactions, returns, and recurring billing. The guide also covers Apple Pay, Apple Pay on the Web, Google Pay, and Visa Checkout. Its PCI Non-Sensitive feature can tokenize private-label and Worldpay gift cards, subject to the Worldpay message interface specification.

Availability and validation

For JavaScript API version 3 or higher, primary and secondary endpoint routing supports high availability. That routing does not address a separate checkout limitation: token exchange does not check CVV or AVS information and does not validate expiration dates. Merchants that need those checks must account for them in their payment flow rather than treating tokenization as validation.

For accessibility, iFrame version 4 improves screen-reader support for expiration fields and error messages; version 3 does not include those upgrades. Choosing the newer version matters for merchants who need those improvements.

Pricing

eProtect is paid, with pricing on request. There are no published tiers or plan terms to compare, so merchants should request a quote and assess it against their expected payment and implementation needs before committing.

Platforms

eProtect supports Android, iOS, web, and API platforms. The Mobile API and browser-based options give teams paths for mobile and web payment experiences, while API support suits integrations built around a merchant’s existing payment architecture.

Who it's for

eProtect is best suited to merchants handling card-not-present payments that want to reduce card-data exposure and use Worldpay OmniTokens for repeat transactions. It is less suitable for organizations seeking a self-serve product with straightforward onboarding: the organization must be enabled and certified to process OmniTokens, obtain a PayPage ID from an eProtect Implementation Consultant, and pass certification testing before production use.

Worldpay lists 24/7 technical support for critical production issues and says representatives respond to eCommerce technical issues within 15 minutes. That is useful for merchants with production payment dependencies, but does not change the need to plan for certification before launch.

Pros and cons

• Pros: Multiple web and mobile integration paths let merchants choose how sensitive fields are handled.
• Pros: Registration IDs and OmniTokens support repeat-payment use cases without routing card data through the merchant web server.
• Pros: iFrame inline validation and configurable behavior can support tailored checkout forms; version 4 adds screen-reader improvements.
• Cons: Enablement, a PayPage ID, and successful certification are prerequisites to production, adding onboarding work.
• Cons: Token exchange does not validate CVV, AVS, or expiration dates, so merchants cannot rely on it for those checks.
• Cons: Pricing on request makes cost comparison harder before engaging Worldpay.

Alternatives

For another tokenization option, compare Payment Tokenization Software.

• American Express Token Service is worth considering for readers seeking a free plan; its stated free option has no deployment or use fees, with availability varying by market.
• Cashfree Token Vault is another paid option across Android, API, iOS, and web.
• Basis Theory may suit teams that want a published platform fee and included token allowance: its Standard platform costs $995 a month and includes 20,000 tokens, with additional tokens at $0.05 each.
• Purse Vault is another paid option for Android, iOS, and web, with pricing available by demo request.
• Razorpay TokenHQ is a paid alternative across Android, API, iOS, and web; its stated checkout costs and saved-card transaction fees may make it relevant to Razorpay users.
• Very Good Security offers a free starting option and a Starter Package at $1,000 a month for teams evaluating a paid platform.
• Cybersource is another paid option across Android, API, iOS, and web, with pricing available by request.
• Paysafe offers a paid Standard option for US/CAD Shopify merchants with no setup or monthly fee and a transaction fee, as well as a Bespoke option with custom pricing.

Verdict

Choose Worldpay eProtect if your organization already works with Worldpay and needs tokenization for card-not-present and repeat payments across web or mobile. Its integration flexibility and separation of card data from the merchant web server are its strongest reasons to choose it. Look elsewhere if you need a simpler route to production, clearer upfront pricing, or token exchange that validates CVV, AVS, and expiration dates.