Decoupled Authentication

In a standard browser or in-app 3D Secure 2 authentication, if a challenge is required it's always presented to the customer as part of the payment process during the transaction. For example, the challenge screen is displayed to the customer in their browser for a maximum of 10 minutes before it times out.

In a decoupled authentication, the authentication of the customer (or challenge) occurs outside of their interaction with the merchant website or app. This method verifies the customer's identity and authenticates the transaction via a separate channel—for example, a push notification to their banking app or via email. Merchants can set a time limit ranging from minutes to up to a week for how long the authentication may take.

Decoupled authentication can be used as an alternative to the standard browser or in-app authentication methods provided by 3D Secure 2. It can also be used for scenarios where the customer does not have access to either a browser or app, for example, pay by text/SMS.

The other use case for decoupled authentication is 3DS Requester (3RI) authentications, also known as merchant-initiated authentications. For more information on 3RI authentications, see our Merchant-Initiated Authentication (3RI) article.

The first thing we need to do before performing a decoupled authentication is set up and configure an endpoint in your application or website that will receive data and event notifications from us.

This endpoint will receive a POST request with the Server Transaction ID (reference) as the URL parameter. This notifies you that the decoupled authentication is complete, and you can get the full authentication data by processing an Obtain Authentication Data request.

For example, if your Decoupled Notification endpoint is:

The POST from our 3D Secure 2 solution will be in the following format:

In any 3D Secure 2 authentication, you must first check what versions of the protocol the card supports. In addition, the ACS Information Indicator field in the Check Availability response tells us what 3D Secure 2 features the Issuer ACS can or cannot support. If the Issuer supports decoupled authentications, one of the values in this field will be: DECOUPLED_AUTHENTICATION_SUPPORTED

For more information on the Check Availability request, see the API Reference for Authentications.

In the authentication request, indicate that you want to perform a decoupled authentication and provide the maximum timeframe allowed, for example, 15 minutes, 2 days, or 1 week. You must also include your Decoupled Authentication URL.

The Issuer responds to confirm whether decoupled authentication will be utilized for this transaction. If so, the Issuer authenticates the customer separately from the standard challenge authentication a customer experiences when purchasing using a browser or in-app. For example, a push notification through their banking app.

For more information on the Initiate Authentication request, see the API Reference for Authentications.

Once authentication is complete, the Issuer sends the result to us. Our 3D Secure 2 solution then sends a POST with the Server Transaction ID to your Decoupled Notification endpoint. At that point, you can use the standard Obtain Result method to obtain the result and the corresponding data necessary for authorization such as the ECI, Authentication Value, and Directory Server Transaction ID.

For more information on the Obtain Result method, see the API Reference for Authentications.

If you're processing the payment with us, now that the 3D Secure process is complete and depending on the ECI value returned, proceed to authorization while including the authentication data.