> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tagada.io/llms.txt
> Use this file to discover all available pages before exploring further.

# 3D Secure

> How the Payments API decides, runs and reports 3D Secure authentication.

With the Payments API you do not start 3D Secure yourself. The API decides whether a card payment needs authentication, runs it, and asks the browser for help only through [`next_action`](https://docs.tagada.io/payments-api/payment-lifecycle#next_action).

## Who authenticates

For each payment, the API picks one path:

| Path | When |
| - | - |
| Processor 3DS | The processor runs 3DS itself. Authorization can come back with a challenge for the shopper. |
| Provider 3DS | The processor accepts an external 3DS result. A 3DS provider authenticates the card **before** authorization. |
| None | Authentication is off, does not apply, or is not available. The reason is recorded on the payment's timeline. |

When both are possible, processor 3DS is preferred.

## When it runs

The store's payment policy sets the mode: `auto`, `always`, `challenge` or `never`, with optional rules and per-processor overrides. In `auto`, the payment authenticates when the issuer asks for it.

## What the browser does

If authentication needs the shopper, the payment moves to `requires_action` with a `next_action` of type `three_ds`:

* `step: "device_data"`: a hidden frame sends the device data to the issuer.
* `step: "challenge"`: a modal frame shows the issuer's challenge.
* `render: "provider_sdk"`: the step runs in the provider's own SDK.

`@tagadapay/core-js/payments-v3` performs all three, then reports the step with `POST /v1/payments/{id}/authentication`. The API reads the outcome from the provider or the processor; it never trusts a result sent by the browser.

## Not available

| Feature | Status |
| - | - |
| Sending your own 3DS result (your own MPI) on create or confirm | Not available. On V2, use `threedsSessionId`. |
| Requesting exemptions | Not available. |
| A standalone authentication endpoint | Not available. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.