Payment Tokenization for Hosted Checkout integration

This guide covers how to create a customer token with Klarna using a hosted checkout integration when the customer is present to provide consent. As an Acquiring Partner, the frontend uses the Klarna Web SDK to present payment methods and collect the customer's selection. The backend then calls the authorizePayment with a tokenization request, handles the STEP_UP_REQUIRED response (which the SDK manages), and securely stores the resulting token for future use.

Where this fits in the integration flow:

1. 1.
   Payment Presentation — The frontend presents Klarna payment methods and collects the customer's selection (previous guide)
2. 2.
   Create a customer token (hosted checkout) — The backend receives the frontend request and calls the authorizePayment with tokenization parameters (this guide)
3. 3.
   Payment Tokenization resource — Conceptual overview of tokenization, token scopes, and authorization patterns

For conceptual understanding of tokenization, token scopes, use cases, and authorization patterns, see the Payment Tokenization resource.

Before starting tokenization through hosted checkout, ensure the following:

• A working Payment Presentation implementation — the frontend can present Klarna payment methods and collect the customer's selection
• A Partner Account onboarded with Klarna
• An API Key and a Client ID associated with your Partner Account
• Registered domains for loading the Klarna Web SDK
• Backend capability to receive and process Klarna webhooks
• A checkout or account setup flow where the customer is present and able to complete step-up interactions
• Clear customer consent for saving the payment method and future charges according to token scope

Once the customer initiates tokenization (for example, during subscription signup, wallet setup, or account creation):

1. 1.
   The Acquiring Partner presents Klarna payment methods using the Klarna Web SDK with the appropriate intent (for example, SUBSCRIBE, SIGNUP, or ADD_TO_WALLET)
2. 2.
   The customer selects a Klarna payment method and clicks the payment button
3. 3.
   The Klarna Web SDK triggers the initiate callback, providing the klarnaNetworkSessionToken and paymentOptionId
4. 4.
   The Acquiring Partner calls the authorizePayment with request_customer_token and step_up_config
5. 5.
   Klarna returns STEP_UP_REQUIRED because customer consent is always required for tokenization
6. 6.
   The Acquiring Partner returns the payment_request_id to the Klarna Web SDK, which launches the Klarna Purchase Journey for the customer to provide consent
7. 7.
   Klarna sends a webhook upon step-up completion. The payload differs by scenario:

   • 7.1.
     Tokenization only: The webhook contains the customer_token. No further API call is needed. The Acquiring Partner securely stores the customer token issued by Klarna, maps it to an internal identifier, and returns that internal customer token identifier to the Partner.
   • 7.2.
     Tokenization combined with authorization: The webhook contains both the customer_token and a klarna_network_session_token. The Acquiring Partner calls the Payment Authorize API again with the klarna_network_session_token to complete the initial Payment Authorization. Klarna returns the final result (APPROVED or DECLINED). The Acquiring Partner then securely stores the customer token issued by Klarna, maps it to an internal identifier, and returns the internal customer token identifier and Payment Authorization result to the Partner.

Determine which tokenization scenario applies to the use case:

• Tokenization only: Save a payment method without an immediate charge

  • Tokenization combined with authorization: Create a token while processing the first Payment Authorization

The appropriate request structure for each scenario is shown in Step 4. See the Payment Tokenization resource for detailed scenario descriptions and use cases.

Collect the necessary information from the Partner to request a customer token. The required fields depend on the tokenization scenario.

Requirements

• Use exact parameter names klarna_network_session_token and klarna_network_data in the Partner-facing API to ensure Partners can easily identify and use them.
• Forward all parameters unmodified to Klarna.
• Parameter validation must not be more restrictive than Klarna's authorizePayment.
• Support all printable UTF-8 characters.
• Supplementary purchase data handling:

  • Map your existing Tokenization settings to Klarna customer token scopes.
  • Map your existing Partner-facing fields (line items, customer billing address, shipping, order reference) into supplementary_purchase_data when calling Klarna.
  • Don't add new Partner-facing fields "just for Klarna" if you already have equivalent fields in your existing schema. Avoid forcing Partners to submit the same data twice using parallel structures

Build the payment form using the Klarna Web SDK. This step follows the same process described in the Payment Presentation guide, with the following tokenization-specific considerations:

Configure the appropriate intent:

The intent parameter in the payment presentation request determines how Klarna presents payment methods. For tokenization scenarios, use the intent that matches the use case:

Payment presentation request example:

const paymentPresentation = await klarna.Payment.presentation({
  amount: 999,        // omit for tokenization-only scenarios without an initial charge
  currency: "USD",
  locale: "en-US",
  intent: "SUBSCRIBE" // use the intent matching the tokenization use case
});

For the complete Web SDK initialization and payment form implementation, see the Payment Presentation guide.

The Acquiring Partner backend receives the authorization request from the frontend after the customer clicks the Klarna payment button. The initiate callback provides two parameters from the Klarna Web SDK:

• klarnaNetworkSessionToken — the Klarna session context
• paymentOptionId — the payment method the customer selected

Call the authorizePayment with the appropriate configuration based on the tokenization scenario.

POST /v2/accounts/{partner_account_id}/payment/authorize
Content-Type: application/json
Klarna-Network-Session-Token: krn:network:us1:test:session-token:eyJhbGciOiJIU[...]

{
  "currency": "USD",
  "request_customer_token": {
    "scopes": ["payment:customer_not_present"],
    "customer_token_reference": "subscription-user-12345"
  },
  "supplementary_purchase_data": {
    "subscriptions": [{

The initial authorizePayment call always returns STEP_UP_REQUIRED for tokenization requests.

When requesting tokenization through the authorizePayment, Klarna returns response objects that correspond to the elements included in the request. The response contains a customer_token_response, and if an initial Payment Authorization was also requested, a payment_transaction_response will be included as well.

What you receive:

• customer_token_response.result: STEP_UP_REQUIRED
• payment_request object containing:

  • payment_request_id: Unique identifier for the step-up request
  • payment_request_url: URL to launch the Klarna Purchase Journey

{
  "customer_token_response": {
    "result": "STEP_UP_REQUIRED"
  },
  "payment_request": {
    "payment_request_id": "krn:payment:us1:request:bcb5ca7d-[...]",
    "payment_request_reference": "acquiring-partner-request-reference-1234",
    "expires_at": "2026-04-01T19:53:15.738Z",
    "created_at": "2026-04-01T16:53:15.738Z",
    "updated_at": "2026-04-01T16:53:15.738Z",
    "state": "SUBMITTED",
    "supplementary_purchase_data": { },

The backend processes the result and returns the payment_request_id to the frontend so the Klarna Web SDK can launch the Klarna Purchase Journey.

app.post('/api/authorize-tokenization', async (req, res) => {
  try {
    const { klarnaNetworkSessionToken, paymentOptionId } = req.body;

    const klarnaResponse = await callKlarnaAuthorizeAPI({
      klarnaNetworkSessionToken,
      paymentOptionId,
      currency: 'USD',
      requestCustomerToken: {
        scopes: ['payment:customer_not_present'],
        customer_token_reference: 'subscription-user-12345'
      },

Configure the payment button's initiate callback to call the backend tokenization endpoint and return the paymentRequestId to the Klarna Web SDK.

async function initiateKlarnaTokenization(klarnaNetworkSessionToken, paymentOptionId) {
  try {
    const response = await fetch('/api/authorize-tokenization', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ klarnaNetworkSessionToken, paymentOptionId })
    });

    if (!response.ok) throw new Error('Network or server error');

    const res = await response.json();

Acquiring Partners must include return URLs in the step_up_config when calling authorizePayment to enable the step-up scenario.

These URLs, set inside the customer_interaction_config object, tell Klarna where to redirect the customer after they complete or stop the Purchase Journey.

If the Klarna Purchase Journey is launched in a web environment, Klarna redirects the customer to the return_url after they finish — whether they complete or stop the flow. This can be a URL managed by the Acquiring Partner (which handles redirection logic) or one collected directly from the Partner.

On mobile, the customer may be redirected to a third-party app (such as a bank app) or the Klarna app during the Purchase Journey. The app_return_url brings the customer back to the Partner's mobile app when this happens.

Partners must register a URL scheme (e.g., yourapp://klarna) or a universal link that resumes the payment flow. Klarna invokes this URL after the customer completes a native app-based step, such as biometric authentication or Klarna app login. Partners are expected to resume the mobile app in its last state without applying state changes or deep link navigations.

The return_url and app_return_url are not mutually exclusive. Depending on the device and environment, either or both may be triggered:

A step-up occurs when Klarna requires additional customer interaction to complete a Payment Authorization — for example, when the customer needs to log in, authenticate, or select a payment method.

When step-up is triggered, authorizePayment returns a STEP_UP_REQUIRED result along with a Payment Request containing the payment_request_id which is required for the Klarna Web SDK to launch the Klarna Purchase Journey.

The Klarna web SDK launches the Purchase Journey through the initiate function on the Klarna Payment button. The function returns a promise that resolves to an object containing the paymentRequestId:

const buttonConfig = {
  initiate: () => {
    // Call to Payment Authorize API returns STEP_UP_REQUIRED
    return { paymentRequestId: "krn:payment:us1:request:552603c0-fe8b-4ab1-[...]" };
  },
  initiationMode: "DEVICE_BEST", // "DEVICE_BEST" (default) | "ON_PAGE" | "REDIRECT"
};

// Render and mount the button with the assigned configuration
paymentPresentation.paymentButton
  .component(buttonConfig)
  .mount("#klarna-button-container");

The initiationMode parameter controls how the Klarna Purchase Journey is launched when your backend returns STEP_UP_REQUIRED. Configure this in your frontend payment button.

The Purchase Journey allows the customer to authenticate with Klarna (via login, one-time passwords, etc.), choose a payment method, and accept the payment.

Phone collection in the Klarna Purchase Journey

Klarna redirects the customer to the return_url in customer_interaction_config, except when a pop-up experience is used and the customer stops the flow.

On completion, Klarna issues a klarna_network_session_token to the Acquiring Partner to finalize the payment.

Acquiring Partners can register event handlers on the KlarnaPayment SDK interface to track Purchase Journey stages:

Event handlers provide access to the following paymentRequest properties:

klarna.Payment.on("complete", (paymentRequest) => {
  console.log("Payment request completed");
  // By default, Klarna will redirect to the submitted return_url upon completion.
  // Return false if you want to prevent the redirection to the success page.
  return true
});

When the payment.request.state-change.completed webhook arrives, tokenization is complete — the customer_token is available in the payload regardless of scenario. For the Tokenization only scenario, no further API call is needed: store the token and return the result to the Partner. For the Tokenization combined with authorization scenario, proceed to Step 8 to finalize the initial Payment Authorization.

To retrieve the required token(s), Klarna provides multiple integration methods. Subscribing to Klarna webhook events is required and may be combined with additional methods to improve resilience.

Using webhooks ensures reliable completion handling, particularly when the customer closes the browser before returning, network interruptions occur during redirects, or post-processing is required before notifying the customer.

Subscribe to the payment.request.state-change.completed webhook event using the Klarna webhook guidelines. Klarna sends this event when the Payment Request reaches the COMPLETED state.

This event indicates that the customer has finished the step-up interaction and that the Acquiring Partner can proceed with finalizing the authorization.

{
  "metadata": {
    "event_type": "payment.request.state-change.completed",
    "event_id": "d9f9b1a0-5b1a-4b0e-9b0a-9e9b1a0d5b1a",
    "event_version": "v2",
    "occurred_at": "2026-04-01T16:55:17Z",
    "correlation_id": "2d1557e8-17c3-466c-924a-bbc3e91c2a02",
    "subject_account_id": "krn:partner:global:account:test:HGBY07TR",
    "recipient_account_id": "krn:partner:global:account:test:LWT2XJSE",
    "product_instance_id": "krn:partner:product:payment:ad71bc48-8a07-[...]",
    "webhook_id": "krn:partner:global:notification:webhook:120e5b7e-abcd-[...]",
    "live": false

As an alternative method, retrieve the Klarna token(s) by calling the readPaymentRequest.

Once the Payment Request reaches the COMPLETED state, the token(s) are available in the state_context object of the Payment Request.

{
  "payment_request_id": "krn:payment:us1:request:bcb5ca7d-[...]",
  "state": "COMPLETED",
  "previous_state": "IN_PROGRESS",
  "state_context": {
    "klarna_customer": {
      "customer_token": "krn:partner:us1:test:identity:customer-token:Rt4iBjqKBM[...]",
      "customer_token_reference": "subscription-user-12345"
    }
  },
  "expires_at": "2026-04-01T19:53:15.738Z",
  "created_at": "2026-04-01T16:53:15.738Z",

This step applies only to the Tokenization combined with authorization scenario. Tokenization is already complete after step-up — the customer_token is delivered in the webhook payload.

To process the initial Payment Authorization, call the authorizePayment using:

• The newly obtained klarna_network_session_token in the Klarna-Network-Session-Token request header
• The same payment context (amount, currency, supplementary_purchase_data, klarna_network_data) used in the initial request
• The same payment_transaction_reference to link the requests

Finalization request example

curl https://api-global.test.klarna.com/v2/accounts/{partner_account_id}/payment/authorize \
  -H 'Authorization: Basic <API key>' \
  -H 'Content-Type: application/json' \
  -H 'Klarna-Network-Session-Token: krn:network:us1:test:session-token:eyJhbGciOiJFU[...]' \
  -d '{
        "currency": "USD",
        "request_payment_transaction": {
          "amount": 999,
          "payment_option_id": "S0xBUk5BXzE3NzI3MjQ5MTQzMjk=",
          "payment_transaction_reference": "subscription-first-payment-001"
        },
        "request_customer_token": {

Klarna evaluates the payment request and returns one of the following results for payment_transaction_response:

{
  "payment_transaction_response": {
    "result": "APPROVED",
    "payment_transaction": {
      "payment_transaction_id": "krn:payment:us1:transaction:5cb3e0e5-a6f0-[...]",
      "amount": 999,
      "currency": "USD",
      "payment_pricing": { "..." : "..." },
      "payment_funding": {
        "type": "GUARANTEED",
        "state": "FUNDED"
      }

Map the Klarna authorization result to the Partner-facing API response and return the klarna_network_response_data.

Requirements

• Treat this value as an opaque string; do not validate or infer its structure.
• Use exact parameter name klarna_network_response_data in the Partner-facing API to ensure Partners can easily identify and use the parameter.
• All returned data MUST be forwarded without modification.

Below is an example of how Acquiring Partners can return the klarna_network_response_data parameter in their Partner-facing APIs.

{
  "payment_id": "pr_27234RBQD9NAKD032BN",
  "amount": 999,
  "currency": "USD",
  "status": "completed",
  "additional_data": {
    "klarna_network_response_data": "{\"content_type\":\"vnd.klarna.network-data.v2+json\",\"content\":{\"operation\":\"payment_request\",\"response\":{\"result\":\"APPROVED\",\"payment_transaction\":{\"payment_transaction_id\":\"krn:payment:us1:transaction:5cb3e0e5-a6f0-[...]\"}}}}"
  }
}

• Payment Tokenization resource — Understand token scopes, authorization patterns, and lifecycle management
• Authorize Partner-initiated transactions — Use the stored customer token to charge customers when they are not present
• Manage payment transactions — Capture, refund, or cancel authorized payments