3D Secure as a service

What is the standalone 3D Secure service?

The standalone 3D Secure service runs PayMe's 3D Secure authentication as its own API call, without charging or authorizing the card. You can rely on the result to authorize or charge the card later, with PayMe or with another gateway.

When to use it

Use it when the card must pass 3D Secure at a specific point in your flow, before any charge. For example, authenticate the card when the customer signs up, then charge it only after you ship the order, or when the customer starts using a service.

How it works

PayMe runs 3D Secure 2 with the buyer's browser data. The issuer either approves the card without asking the buyer anything (frictionless), or asks for a challenge, such as a one-time code.

1. Start authentication. Collect the browser data with PayMe's JS library (3DS integration using JS API), then call Start 3D Secure authentication (POST /sales/{payme_sale_id}/3ds) with the card and the browser data. A frictionless approval returns hash_3dsecure at once. A challenge returns a redirect_url for the buyer, and the hash comes back after the challenge.
2. Resolve the hash. Call Resolve a 3D Secure hash (GET /sales/{payme_sale_id}/3ds/{hash_3dsecure}) from your server with the seller's MPL. You get eci, cavv and xid to send to your gateway.

The seller must have the 3D Secure service active; otherwise the call returns error 720. The full flow: Standalone 3D Secure: process flow.

When PayMe applies 3D Secure to its own sales

On sales that PayMe processes, rules on the account can apply 3D Secure automatically: a minimum amount, a minimum number of installments, and cards issued abroad. The amount rule compares the sale's amount in minor units with the account's threshold, without converting currencies. A card counts as foreign when its issuing country differs from the seller's registered country.