Saved Cards / Payment Vault for Magento 2

Key Features

Tokenized stored cards via Magento's native Vault framework (`Magento\Vault`) — only gateway tokens persist in `vault_payment_token`, never raw PAN/CVV

One-click repeat checkout: returning, logged-in shoppers place orders against a saved card with no card re-entry

Admin MOTO card payments from the Sales > Create New Order screen for phone and back-office orders

Multi-gateway vault support — adapted to your PSP (Stripe, Braintree, Authorize.Net, Adyen, or another tokenizing gateway)

3-D Secure 2 (3DS) step-up challenge re-triggered on stored cards when gateway/risk rules require authentication

Dedicated admin ACL resource so only authorized roles can view, charge, or manage vaulted cards

REST and GraphQL API endpoints to list, add, and delete saved cards for headless and PWA Studio storefronts

Customer account 'Stored Payment Methods' grid to manage and remove their own cards

Built as a clean module under `app/code/Ecosire/PaymentVault` using `di.xml`, plugins and service contracts — zero core hacks

Works on Magento Open Source and Adobe Commerce, multi-store and multi-website aware

Configurable system.xml admin settings (enable per store-view, allowed gateways, 3DS policy, vault retention)

Optional cron-based housekeeping to expire or purge stale tokens in line with your data-retention policy

Built to order, done for you

No DIY setup — a working app, built, installed and supported by ECOSIRE.

You order

Start with a one-time build price. We scope it with you at kickoff.

We build & install

ECOSIRE builds, configures and installs it on your Magento 2.

Go live + support

You go live in about 2–4 weeks, with a post-launch support window.

About this Product

Returning customers abandon checkout when they have to re-key a 16-digit card every order. This extension gives Magento 2 (Open Source) and Adobe Commerce a proper tokenized payment vault built on the platform's native Vault framework (Magento\Vault) so cards are never stored on your server — only gateway-issued tokens land in vault_payment_token, keeping you in PCI-DSS SAQ-A / SAQ-A-EP scope.

We deliver it as a versioned module under app/code/Ecosire/PaymentVault, wired through di.xml, service contracts and payment-method plugins rather than core edits, so it survives setup:upgrade and Magento minor releases. Stored cards drive a one-click repeat checkout: a logged-in shopper picks a vaulted card and places the order without re-entering PAN/CVV, with an optional 3DS step-up (3-D Secure 2 challenge) re-triggered on the gateway when risk rules require it.

Your team gets admin MOTO (Mail Order / Telephone Order) card capture from the order-create screen, gated behind a dedicated ACL resource so only authorized agents can charge saved cards. The vault is gateway-agnostic: we adapt it to the gateway you already run (Stripe, Braintree, Authorize.Net, Adyen, or another tokenizing PSP) through a clean payment-method integration, and expose stored-card management over REST and GraphQL for headless/PWA storefronts.

This is build-to-order. After purchase, ECOSIRE scopes your gateway and Magento version, builds the module, installs it on your staging environment, runs setup:upgrade / setup:di:compile, validates a live tokenized transaction, and then deploys to production. You are not downloading an unsupported Marketplace package — you get a tested module plus onboarding and a support window.

What you get

Custom Magento 2 module (`Ecosire_PaymentVault`) delivered as installable source under `app/code` plus a Composer-installable package

Integration with your specific payment gateway's tokenization / Vault API

Installation and configuration on your staging environment, including `setup:upgrade` and `setup:di:compile`

A validated end-to-end test: tokenize a card, place a one-click repeat order, and run a 3DS step-up

Admin user guide covering MOTO order capture, ACL setup, and vault configuration

REST/GraphQL API documentation for the saved-card endpoints (for headless storefronts)

Production deployment assistance and a post-launch support window with bug fixes and compatibility patches

Who this is for

Subscription & replenishment merchant

Sells consumables or memberships where the same customers reorder frequently. Wants returning buyers to check out in one click against a stored card to lift repeat-purchase conversion and reduce abandonment.

B2B / wholesale store with phone orders

Takes a meaningful share of orders by phone or email. Needs admin MOTO card capture against saved cards from the order-create screen, locked behind ACL so only trained agents can charge them.

Headless / PWA storefront team

Runs a decoupled frontend (PWA Studio or custom React/Vue) on Magento and needs saved-card management exposed cleanly over GraphQL and REST, with tokens handled server-side and PCI scope minimized.

How Saved Cards / Payment Vault for Magento 2 Compares

Criterion	ECOSIRE	Custom Build	Competitor
PCI-safe tokenization via Magento native Vault (no PAN stored)	Included	Partial support	Included
One-click repeat checkout for returning shoppers	Included	Partial support	Partial support
Admin MOTO card capture against saved cards with ACL gating	Included	Partial support	Partial support
Adapted to your specific gateway (Stripe/Braintree/Authorize.Net/Adyen/other)	Included	Included	Partial support
3DS 2 step-up challenge re-triggered on stored cards	Included	Partial support	Partial support
REST + GraphQL endpoints for headless/PWA saved-card management	Included	Partial support	Partial support
Installed, validated on staging, and deployed by the vendor	Included	Partial support	Not included
Post-launch support window with compatibility patches	Included	Partial support	Partial support

Frequently Asked Questions about Saved Cards / Payment Vault for Magento 2

Does this store actual credit card numbers on my server?

No. The extension uses Magento's native Vault framework, so the raw PAN and CVV are sent directly to your tokenizing gateway and only a gateway-issued token plus non-sensitive metadata (last four digits, card type, expiry) are saved in the `vault_payment_token` table. This keeps you in the lighter PCI-DSS SAQ-A / SAQ-A-EP scope rather than handling cardholder data yourself.

Which payment gateways are supported?

The vault is gateway-agnostic. We adapt it to the tokenizing PSP you already run — Stripe, Braintree, Authorize.Net, Adyen, or another gateway that supports card tokenization. During scoping we confirm your gateway's Vault/token API so one-click charges and 3DS step-up work correctly. Multi-gateway setups can be supported on request.

Will this work with my headless / PWA storefront and with Adobe Commerce?

Yes. Saved-card list, add, and delete operations are exposed over both REST and GraphQL, so a PWA Studio or custom decoupled frontend can manage the vault. The module runs on both Magento Open Source and Adobe Commerce and is multi-store/multi-website aware.

How long until it's delivered and installed?

This is build-to-order, not an instant download. Typical delivery is about 2 to 4 weeks depending on your gateway, Magento version, and any headless requirements. After purchase we scope your environment, build the module, install it on staging, validate a live tokenized transaction and a 3DS step-up, then deploy to production with you.

What about ongoing support and updates after launch?

Every build includes a post-launch support window covering bug fixes and compatibility patches for the Magento/Adobe Commerce version you're on. Because it's built as a clean module using di.xml, plugins and service contracts, it survives `setup:upgrade` and minor releases. Extended support, version upgrades, and new-gateway additions are available as a follow-on engagement.