Token.io
Pay by Bank infrastructure - reimagined
Supports in this guide: Payments
Provider website: token.io
What you need to do for start processing transactions (brief summary)
- Get your credentials (from Token.io)
- Set your receiving bank account details (Constants)
- Connect in Dashboard
- Send an API request
Prerequisites: get from Token.io
Contact your Token.io account manager to get your account verified and receive the following credentials.
- Merchant ID -> Corefy field
merchant_id. - Member ID -> Corefy field
member_id. - Key Type -> Corefy field
key_type-> one ofED25519,ECDSA_SHA256,RS256, matching the key pair you registered with Token.io. - Public Key ID -> Corefy field
public_key_id. - Private Key -> Corefy field
private_key-> uploaded as a file; used to sign every request. - Webhook Public Key -> Corefy field
webhook_public_key-> used to verify callback notifications from Token.io.
Important
Token.io is an open banking (Pay by Bank) provider - there's no card data involved. Instead, your own receiving bank account details (IBAN, name, and more) must be configured as connection Constants for each payment method before you can accept payments with it - see Constants below.
Payments processing (connect Provider account, create payment-invoice)
Connect Provider account in Corefy Dashboard
Step 1 - Open connection form
Open Token.io in the provider directory and press Connect at Token.io Provider Overview page in the New connection section. Choose Provider account.
Step 2 - Fill in fields and select settings
- Merchant ID
- Member ID
- Key Type
- Public Key ID
- Private Key
- Webhook Public Key
- Test Mode -> (enable if you are using sandbox credentials)
For each payment method/service you plan to use, fill in your receiving bank account Constants (see below) - Creditor IBAN and Creditor Name are required.
Success
You have connected Token.io Provider account!
First request to Corefy API (MIN)
What it does: creates a payment-invoice and redirects the customer to their own bank (or a provider like Revolut/N26/Wise) to authorize an account-to-account transfer. All methods are EUR only. Depending on the method, fields.iban (the payer's own IBAN) may be required to initiate the transfer.
Payment - MIN
POST /api/payment-invoices
{
"data": {
"type": "payment-invoice",
"attributes": {
"reference_id": "8e3dbbb0-17af-4c9a-bedb-93bdac6900a2",
"service": "sepa_transfer_eur_hpp",
"currency": "EUR",
"amount": 10
}
}
}
This connector also supports sepa_transfer_instant_eur_hpp, revolut_bank_eur_hpp, n26_bank_eur_hpp, wise_eur_hpp, sofortuberweisung_eur_hpp.
Payment - MAX
POST /api/payment-invoices
{
"data": {
"type": "payment-invoice",
"attributes": {
"reference_id": "6795502c-e27d-4d07-85e0-93245aab9a3f",
"service": "sepa_transfer_eur_hpp",
"currency": "EUR",
"amount": 10,
"customer": {
"reference_id": "cus_123",
"name": "John Smith",
"address": {
"country": "DE",
"city": "Berlin",
"full_address": "1 Main street",
"post_code": "10115"
}
},
"fields": {
"iban": "DE89370400440532013000"
}
}
}
}
Important
customer.name and fields.iban are only forwarded to Token.io as a pair - if either is missing, neither is sent, and Token.io's own hosted flow collects the payer's bank details instead.
Extended request (MAX)
Why add extra fields (typical reasons): - Provide additional customer details for compliance/reconciliation - Positively influence conversion rate - Include optional fields required by your specific flow
Options
charge_bearer-> optional, enum (CRED/DEBT/SHAR/SLEV) - who pays the transfer fee: creditor (you), debtor (the customer), shared between both, or per the service level agreement. Configured per payment method/service.
Constants (your receiving bank account)
Unlike most connectors, these Constants aren't fallback values - they're the only way Token.io learns where to send the money, since the API request never carries your own bank details. Configure them once per payment method/service.
Available constants (constant -> meaning)
creditor_iban-> required -> your IBAN.creditor_name-> required -> your account/business name as registered with your bank.creditor_bic-> optional -> your bank's BIC/SWIFT code.creditor_ultimate_name-> optional -> ultimate beneficiary name, if different from the account holder.creditor_bank_name-> optional -> your bank's name.creditor_address_line,creditor_street_name,creditor_building_number,creditor_post_code,creditor_town_name,creditor_state,creditor_district,creditor_country-> optional -> your registered business address, broken into parts.
Additional info
- Callback routing is automatic - Corefy generates the callback/return URLs per transaction, nothing to configure in Token.io's own back-office.
- No refunds and no payouts - this connector does not support refunds or payouts through Corefy.
FAQ / Troubleshooting
- Connection fails with an invalid key/algorithm error -> verify that Key Type matches the key pair you generated and registered with Token.io, and that the uploaded Private Key corresponds to the Public Key ID
- Payment fails with no receiving account configured -> make sure Creditor IBAN and Creditor Name constants are set for the specific payment method/service you're using
- Currency or service is not supported -> confirm allowed methods in your Token.io account and in Corefy - all methods are EUR only
Question
Still looking for help connecting your Token.io account? Please contact our support team!