A method comprising: receiving, by a primary device, device data of a secondary device; transmitting, by the primary device, a provision request to an authorization server to request account credentials associated with an account, wherein the provision request comprises the device data of the secondary device, an identifier of the primary device and an account identifier associated with the account; receiving, by the primary device, a provision response from the authorization server, wherein: the provision response comprises encrypted account credentials, comprising a first part and a second part, and a shared key associated with the primary device; and the encrypted account credentials comprise account credentials that have been encrypted, by the authorization server, using a key-encryption key, the account credentials having been generated by the authorization server, and the key-encryption key having been generated, by the authorization server, from the shared key and the device data of the secondary device; storing, by the primary device, the shared key and the first part of the encrypted account credentials; transmitting, by the primary device, the second part of the encrypted account credentials to the secondary device, wherein the secondary device is configured to store the second part of the encrypted account credentials; transmitting, by the primary device, a request for credential data of the secondary device; receiving, by the primary device, the credential data of the secondary device and the second part of the encrypted account credentials, the credential data including the device data of the secondary device; deriving, by the primary device, the key-encryption key by encrypting the device data of the secondary device using the shared key; decrypting, by the primary device, the first part and the second part of the encrypted account credentials using the key-encryption key to obtain a token and a cryptogram key; generating, by the primary device, a cryptogram based at least in part on the cryptogram key; transmitting, by the primary device, an authorization request to an access device to request authorization to use the account associated with the account credentials, wherein the authorization request comprises the token and the cryptogram. receiving, by a primary device, device data of a secondary device; transmitting, by the primary device, a provision request to an authorization server to request account credentials associated with an account, wherein the provision request comprises the device data of the secondary device, an identifier of the primary device and an account identifier associated with the account; receiving, by the primary device, a provision response from the authorization server, wherein: the provision response comprises encrypted account credentials, comprising a first part and a second part, and a shared key associated with the primary device; and the encrypted account credentials comprise account credentials that have been encrypted, by the authorization server, using a key-encryption key, the account credentials having been generated by the authorization server, and the key-encryption key having been generated, by the authorization server, from the shared key and the device data of the secondary device; the provision response comprises encrypted account credentials, comprising a first part and a second part, and a shared key associated with the primary device; and the encrypted account credentials comprise account credentials that have been encrypted, by the authorization server, using a key-encryption key, the account credentials having been generated by the authorization server, and the key-encryption key having been generated, by the authorization server, from the shared key and the device data of the secondary device; storing, by the primary device, the shared key and the first part of the encrypted account credentials; transmitting, by the primary device, the second part of the encrypted account credentials to the secondary device, wherein the secondary device is configured to store the second part of the encrypted account credentials; transmitting, by the primary device, a request for credential data of the secondary device; receiving, by the primary device, the credential data of the secondary device and the second part of the encrypted account credentials, the credential data including the device data of the secondary device; deriving, by the primary device, the key-encryption key by encrypting the device data of the secondary device using the shared key; decrypting, by the primary device, the first part and the second part of the encrypted account credentials using the key-encryption key to obtain a token and a cryptogram key; generating, by the primary device, a cryptogram based at least in part on the cryptogram key; transmitting, by the primary device, an authorization request to an access device to request authorization to use the account associated with the account credentials, wherein the authorization request comprises the token and the cryptogram.