Credential on File (CoF) payments

Credential-on-file (CoF) refers to a payment model in which a shopper authorizes a merchant or payment provider to store their payment credentials for future use. Subsequent payments can then be processed using tokenized stored credentials, without requiring the shopper to re-enter their details each time.

Common CoF payments include:

• Recurring payments: Repeated charges where a shopper gives ongoing permission to charge their card or local payment methods for a product or service, for example, subscriptions, installments, usage‑based billing, or utility bills.
• One-click checkout: Returning shopper pays in session with previously saved credentials.

In Airwallex, a CoF setup usually involves the following objects:

• Customer: Identifies the shopper in your system and in Airwallex.
• PaymentMethod: Tokenized representation of the card or local payment method credentials. Airwallex uses gateway tokenization to minimize your handling of sensitive card data, reducing PCI compliance requirements.
• PaymentConsent: The payment agreement that defines how a stored credential may be reused.
• PaymentIntent: Represents a specific payment you want to collect.

Together, these objects form the foundation for securely storing payment credentials and reusing them for future transactions.

How CoF payments work

CoF payments require the shopper to explicitly authorize you to store their payment credentials under a payment agreement, so you can securely reuse those credentials for later charges under that same agreement.

To build this flow correctly and to protect approval rates, liability, and compliance, you need to be explicit about how credentials are first saved (with or without an immediate payment), who triggers each payment, whether it's a first transaction or a later one in the series, and how recurring terms are represented in Airwallex objects and in the indicators you pass to card schemes and local payment providers.

Who triggers the payment with saved payment details?

Who triggers the payment, shopper vs merchant, determines whether the transaction is treated as customer-initiated transaction (CIT) or merchant-initiated transaction (MIT) and which Strong Customer Authentication (SCA) and 3D Secure (3DS) rules apply. You must correctly flag MIT/CIT indicators in your transaction request as this affects approval rates, liability, and compliance.

Customer-initiated transaction (CIT)

CIT is used when the shopper is in session and chooses to save credentials for future use, with or without a payment. For saved cards, the shopper may be required to enter their security code (CVC) for verification to complete the initial authorization.

A one-click checkout is a subsequent CIT where a returning shopper completes a purchase using previously stored payment credentials allowing faster checkout without re-entering card details.

CIT examples include one‑click checkout for returning shoppers, a shopper upgrading their SaaS plan in‑app or paying an invoice via an Airwallex-hosted payment page.

Merchant-initiated transaction (MIT)

MIT enables you as a merchant to initiate scheduled (recurring) or unscheduled (one-time) payments without the shopper involved, based on a prior agreement with the shopper. MIT requires a prior CIT where the shopper authorized credential storage. Once credentials are saved with shopper authorization, all subsequent MITs can be automatically processed using that original authorization.

MIT examples include subscription renewals, usage‑based top‑ups and post‑service charges, installment plan payments.

MITs can increase costs and risk because unclear subscription terms or delayed charges often lead to disputes. Setting up MITs is also subject to stricter controls, such as SCA, mandated by regulators and card scheme rules. For effective management of MITs, refer to the best practices guide.

Is it the first or a subsequent transaction in the series?

Schemes and regulators distinguish between the initial transaction that sets up the payment agreement and subsequent transactions that use it.

Initial transaction

The initial transaction sets up a new payment agreement and creates or verifies the credential‑on‑file (PaymentMethod) and the agreement (PaymentConsent).

If it's the shopper's first time saving payment details, the initial transaction must be a CIT with SCA/3DS authentication. If credentials were previously saved, the initial transaction for a new agreement can be either a CIT (shopper present) or an MIT (merchant-initiated with prior authorization).

There are two common scenarios for the initial transaction:

• Zero-amount setup: Payment details are set up for future use without an immediate charge. Typical for onboarding or when subscription billing will begin later.
• Payment with credential storage: Shopper makes a one-off purchase and opts in to save payment details as part of the checkout for future use.

Examples of initial transactions include first card save in a one-time checkout flow, first month of a subscription when the shopper agrees to auto-renew, or first installment of a payment plan.

Subsequent payments

Subsequent payments are later charges under the same agreement (renewals, future installments, top-ups). They usually run with less shopper friction if the initial transaction was correctly authenticated and flagged.

This distinction matters for how you populate CoF fields and when additional authentication may be required.

How are the payment agreement terms captured and represented?

To be compliant and maintain high approval rates, the payment agreement terms and recurring semantics must be captured and represented correctly to card schemes and local payment providers.

• Clear checkout and subscription terms: Display subscription costs, frequency, and renewal/cancellation policies prominently before the shopper completes a transaction.
• Correct indicators in payment objects: PaymentIntent metadata, PaymentConsent, local payment method specific fields.
• Transparent communications and reminders: Send pre-renewal notifications several days before a subscription is due to renew.
• Easy cancellation paths: Give shoppers a direct, unobstructed path to cancellation from their profile or billing management page.

For detailed guidance, see best practices for handling MITs.

Types of CoF payments

The following CoF payment types are available via Airwallex Payments and Airwallex Billing.

See also

• Recurring payments
• Airwallex Billing
• Network tokenization
• Card Account Updater