Key Injection for Payment Terminals: What ISOs Need to Know

Hardware insights · For ISOs & processors

Key injection is the step that turns a new PIN pad into one your processor will accept. Until the right encryption keys are loaded, a terminal can't take PIN debit, can't encrypt card data for P2PE, and can't connect to your gateway. This guide covers the kinds of key injection an ISO deals with, how the process works, when remote key injection is an option, and what to check before you order devices in volume.

Service prices and product prices from our catalog as of 25 September 2026.

• What it is
• The three types
• How it works
• Remote vs bench
• ISO checklist
• Key sets
• Terminals
• Cost
• FAQ

What is key injection?

Key injection is the process of loading cryptographic keys into a payment terminal's secure memory so it can encrypt a cardholder's PIN, their card data, or both. The keys are derived from master keys held by the processor or a key-management provider. They must be loaded in a controlled, audited environment called a key injection facility, or delivered over an encrypted connection through remote key injection.

What has to be loaded depends on how the terminal will be used:

The three types of key injection ISOs deal with

How key injection works

Most PIN pads in North America use DUKPT (Derived Unique Key Per Transaction), defined in the ANSI X9.24 standard. It's worth understanding because it explains why keys can't simply be copied from one device to another.

1. The processor holds a master key. A Base Derivation Key (BDK) lives inside a hardware security module and never leaves it.
2. Each device gets its own starting key. A unique initial key is derived from the BDK and the device's Key Serial Number (KSN).
3. That key is loaded into tamper-responsive memory, either in a key injection facility under dual control and split knowledge, or remotely over an encrypted channel.
4. Every transaction uses a fresh key. The terminal derives a new one-time key per transaction, so a key captured from one payment can't decrypt another.
5. The processor decrypts. Because it holds the BDK, it derives the same key from the KSN and decrypts the PIN block.

Remote key injection vs bench injection

Remote key injection (RKI) delivers keys to a device over the network, using asymmetric cryptography under the ANSI X9 TR-34 standard, instead of loading them by hand in a facility. It's useful for re-keying a fleet that's already deployed. It isn't universal: the device needs RKI certificates loaded at manufacture, and the processor or key host has to support it.

What ISOs should check before ordering

Most key injection delays come from missing information, not from the injection itself. Have these answers ready before you place a volume order:

• Processor and key set. Which processor, and do you need a PIN key, a data key, or both? If you don't know the key set name, your processor can give you the Key Set Identifier (KSI) or BIN number, and we can locate it from that.
• Device model and PCI PTS approval. Confirm the model is on the PCI approved PIN transaction device list and check the approval expiry date, especially for refurbished units bought in bulk.
• Integration. Standalone, or integrated through Datacap, NMI or a processor semi-integration? The application load is different for each.
• Debit networks. Which PIN debit networks your merchants need, such as Star, NYCE, Pulse or Accel. Your processor handles the routing, so confirm your network coverage with them; the injected PIN key just has to match that processor.
• Previously deployed devices. Terminals released by another processor may need to be unlocked before they can be keyed again.
• Proof of injection. Ask for a certificate of completion per device. We include one with every debit injection.

Processor key sets we can inject

We hold 190 encryption key sets across First Data, TSYS, Chase Paymentech, Worldpay and other processors and sponsor banks, and we can track down others on request. Open your processor below to find your key set by name, or use your browser's find-in-page to search.

Key set names are the labels processors and sponsor banks give their encryption keys. A merchant or bank name in a key set label doesn't mean we have a relationship with that business.

PIN pads and terminals we key regularly

These are the devices ISOs most often send through injection with us. Each can ship keyed for your processor. Browse the full range of PIN pads, PAX terminals and Ingenico terminals.

Retail PIN pad · RefurbishedPAX S300From $242View → External PIN padPAX SP30From $232View → PIN padVerifone Engage P200From $204.98View → Android multi-lane PIN padPAX A35From $299View → Android countertop terminalPAX A80From $277View → Android wireless terminalPAX A920 ProFrom $422View →

What key injection costs

Debit injection has a fixed price. Data key injection and configuration depend on the processor, gateway and key set, so we quote them per deployment.

Key injection FAQ