Skip to main content
With the Payments API you do not start 3D Secure yourself. The API decides whether a card payment needs authentication, runs it, and asks the browser for help only through next_action.

​
Who authenticates

For each payment, the API picks one path: When both are possible, processor 3DS is preferred.

​
When it runs

The store’s payment policy sets the mode: auto, always, challenge or never, with optional rules and per-processor overrides. In auto, the payment authenticates when the issuer asks for it.

​
What the browser does

If authentication needs the shopper, the payment moves to requires_action with a next_action of type three_ds:
  • step: "device_data": a hidden frame sends the device data to the issuer.
  • step: "challenge": a modal frame shows the issuer’s challenge.
  • render: "provider_sdk": the step runs in the provider’s own SDK.
@tagadapay/core-js/payments-v3 performs all three, then reports the step with POST /v1/payments/{id}/authentication. The API reads the outcome from the provider or the processor; it never trusts a result sent by the browser.

​
Not available