Systems and methods for using a cryptogram lockbox

A system, comprising:

• a plurality of merchant point of sale devices;
• a merchant datacenter comprising:
• a merchant-specific cryptogram lockbox executing a lockbox computer program, wherein the merchant-specific cryptogram lockbox generates cryptograms for a plurality of merchant point of sale devices;
• a merchant backend in communication with a plurality of merchant point of sale devices;
• a merchant general gateway;
• and
• a merchant outbound gateway;
• and
• a financial institution backend;
• wherein:
• the financial institution backend provides a startup code comprising a unique value that authorizes use of the merchant-specific cryptogram lockbox by a merchant to the merchant backend using the merchant general gateway;
• the merchant backend communicates the startup code to the merchant-specific cryptogram lockbox;
• the lockbox computer program generates a call comprising the startup code and cryptogram lockbox metadata for the merchant-specific cryptogram lockbox;
• the lockbox computer program encrypts the call with a public key for the financial institution backend;
• the lockbox computer program calls the financial institution backend with the encrypted call using the merchant outbound gateway;
• the merchant-specific cryptogram lockbox establishes a secure communication channel with the financial institution backend, wherein the secure communication channel uses IP whitelisting;
• the merchant-specific cryptogram lockbox receives limited use keys from the financial institution backend over the secure communication channel;
• the merchant-specific cryptogram lockbox receives a call comprising a request for a cryptogram and a payment token for an account in a transaction from one of the plurality of merchant point of sale devices;
• the merchant-specific cryptogram lockbox generates the cryptogram for the payment token using the limited use keys;
• the merchant-specific cryptogram lockbox returns the cryptogram to a merchant backend;
• the merchant point of sale device combines the cryptogram and the payment token;
• and
• the merchant backend conducts the transaction with the combined cryptogram and the payment token.

A non-transitory computer readable storage medium, including instructions stored thereon, which when read and executed by one or more computer processors, cause the one or more computer processors to perform steps comprising:

• receiving a startup code comprising a unique value that authorizes use of a merchant-specific cryptogram lockbox by a merchant from a financial institution backend via a merchant general gateway, wherein the merchant-specific cryptogram lockbox generates cryptograms for a plurality of merchant point of sale devices;
• generating a call comprising the startup code and cryptogram lockbox metadata for the merchant-specific cryptogram lockbox;
• encrypting the call with a public key for the financial institution backend;
• calling the financial institution backend with the encrypted call using a merchant outbound gateway;
• establishing a secure communication channel with the financial institution backend, wherein the secure communication channel uses IP whitelisting;
• receiving, by the merchant-specific cryptogram lockbox, limited use keys from the financial institution backend over the secure communication channel;
• receiving, from one of a plurality of merchant point of sale devices, a call comprising a request for a cryptogram and a payment token for an account in a transaction;
• generating the cryptogram for the payment token using the limited use keys;
• combining the cryptogram and the payment token;
• and
• conducting the transaction with the combined cryptogram and the payment token.