Cashfree Payment Gateway - Token Vault (RBI Card Tokenization)

Implements RBI-compliant card tokenization and saved-card checkout via Cashfree Token Vault APIs.

Updated Sep 8, 2026

Search Tags:#webhooks #payment gateway #saved cards #cashfree #card tokenization #rbi compliance #card-on-file

Ready to run

npx skills add https://github.com/dasara-varun/orange --skill cashfree-payment-gateway-token-vault-rbi-card-tokenization-dasara-varun

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: Cashfree Payment Gateway - Token Vault (RBI Card Tokenization)
Source: https://github.com/dasara-varun/orange/tree/main/.cursor/cashfree-skills/pg/token-vault
Command: npx skills add https://github.com/dasara-varun/orange --skill cashfree-payment-gateway-token-vault-rbi-card-tokenization-dasara-varun

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Indian merchants can no longer legally store raw card numbers (PAN) due to RBI's 2022 tokenization mandate, yet customers expect saved-card and OneClick checkout. This Skill guides developers through Cashfree's Token Vault so they can offer saved-card payments, card-on-file charges, and instrument management without ever touching raw card data. ## Core Features & Use Cases - Consent-based card saving: Capture `save_instrument` at first payment and handle the asynchronous `INSTRUMENT_ACTIVE_WEBHOOK` / `INSTRUMENT_FAILED_WEBHOOK` lifecycle. - Saved-card management: List, fetch, and delete customer instruments via `PGCustomerFetchInstruments`, `PGCustomerFetchInstrument`, and `PGCustomerDeleteInstrument` for checkout UIs and GDPR/DPDP deletion requests. - Card-on-file charging: Pay with a saved `instrument_id`, or fetch a one-time cryptogram for headless recurring charges, with CVV and 3DS edge-case handling. - Use Case: A subscription merchant saves a customer's Visa card at first checkout, waits for the ACTIVE webhook, then charges renewals using the stored `instrument_id` without re-collecting card details. ## Quick Start Ask the AI to implement saved-card checkout with Cashfree Token Vault, including the save_instrument consent flag, INSTRUMENT webhook handling, and paying with a saved instrument_id.

Frequently Asked Questions about Cashfree Payment Gateway - Token Vault (RBI Card Tokenization)

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I save a card for future payments with Cashfree?▼

Set save_instrument: true in the Order Pay call when the customer enters card details the first time. Cashfree then performs asynchronous network tokenization, and you must wait for the INSTRUMENT_ACTIVE_WEBHOOK before showing the card as saved.

How do I charge a saved card using Cashfree Token Vault?▼

Create an order as usual, then call PGPayOrder with payment_method.card.instrument_id set to the saved instrument instead of raw card details. CVV may be required on first reuse depending on network policy, and 3DS challenges are handled like normal card payments.

Is it legal for Indian merchants to store card numbers?▼

No. Since October 2022, RBI prohibits merchants and payment aggregators from storing raw PAN, CVV, or expiry data. Merchants must use network tokens issued by Visa, Mastercard, or RuPay through a token vault like Cashfree's.

Why is my saved card not appearing after a successful payment?▼

Tokenization is asynchronous, so the instrument is not usable immediately after payment. Wait for the INSTRUMENT_ACTIVE_WEBHOOK before listing it; if you receive INSTRUMENT_FAILED_WEBHOOK, the issuer rejected tokenization and the customer must re-enter the card.

Does Cashfree tokenization work for international cards?▼

No. RBI tokenization applies to Indian-issued cards only; foreign-issued cards are not supported through this token vault. Amex and Diners have limited support, so fall back to a non-saved flow when tokenization fails.

How do I handle a customer request to delete a saved card?▼

Call DELETE /pg/customers/{customer_id}/instruments/{instrument_id} to remove the instrument, which satisfies RBI and DPDP deletion requirements. Refunds on prior transactions still work because they route to the underlying card through the network.