Token offline provisioning

A second user device comprising:

• a processor;
• and
• a non-transitory computer readable medium coupled to the processer, the non-transitory computer readable medium comprising code executable by the processor for performing a method including:
• generating a first access token for a first user device using a primary access identifier, a first salt, and a first variable value comprising a counter value that is an incremented value and identifies the first user device in an interaction;
• and
• transmitting, to the first user device, the first access token, the first salt, and the first variable value,
• wherein the second user device is configured to generate a plurality of access tokens for a plurality of user devices using the primary access identifier, a plurality of variable values, and a plurality of salts, respectively,
• wherein each of the plurality of variable values uniquely identifies a corresponding user device among the plurality of user devices,
• wherein the first user device provides to an access device in the interaction, the first access token, the first variable value, and the first salt,
• wherein the access device generates an authorization request message comprising the first access token, the first variable value, and the first salt, and transmits the authorization request message to a remote server computer that determines the primary access identifier based on the authorization request message and uses the primary access identifier to determine if a user of the first user device is authorized to conduct the interaction, and
• wherein the first user device is one of the plurality of user devices, the first access token is one of the plurality of access tokens, the first variable value is one of the plurality of variable values, and the first salt is one of the plurality of salts.

A method comprising:

• receiving, by a remote server computer as a part of an interaction, an authorization request message comprising interaction information, a first access token, a first variable value, and a first salt that correspond to a first user device, wherein the first variable value comprises a counter value that is an incremented value and identifies the first user device in the interaction;
• determining, by the remote server computer, a primary access identifier based on the authorization request message;
• and
• determining, by the remote server computer, if a user of the first user device is authorized to conduct the interaction based on the primary access identifier,
• wherein the first access token is generated by a second user device using the primary access identifier, the first variable value, and the first salt and is transmitted to the first user device,
• wherein the second user device is configured to generate a plurality of access tokens for a plurality of user devices using the primary access identifier, a plurality of variable values, and a plurality of salts, respectively, the first user device being one of the plurality of user devices, the first access token being one of the plurality of access tokens, the first variable value being one of the plurality of variable values, and the first salt being one of the plurality of salts, and
• wherein each of the plurality of variable values uniquely identifies a corresponding user device among the plurality of user devices.