Native 3D Secure 2 authentication

This page explains how to implement native 3D Secure 2 authentication with your existing iOS Drop-in integration.

Requirements

Before you begin, take into account the following requirements, limitations, and preparations.

How it works

Our iOS Drop-in renders the available cards in your payment form, and securely collects any sensitive card information, so it doesn't touch your server. Drop-in also handles the 3D Secure 2 device fingerprinting and challenge flows, including the data exchange between your front end and the issuer's Access Control Server (ACS).

When making a card payment with native 3D Secure 2 authentication, you need to:

1. Configure Drop-in to collect the cardholder name.
2. Provide additional parameters when making a payment request.
3. Submit the authentication result if you receive an action object in response to your /payments or /payments/details request.
4. In some cases, the payment may be routed to the redirect flow, when this happens, handle the redirect.

Collect additional parameters in your payment form

For higher authentication rates, we strongly recommend that you collect the shopper cardholder name and billing address in advance in your payment form. Deliver these parameters to your backend when making a payment, because they are required by the card schemes.

Show the available cards in your payment form

To show cards in your payment form:

1. Specify in your /paymentMethods request a combination of countryCode and amount.currency. Drop-in uses this information to show the available cards to your shopper.

2. When initializing the Drop-in, create a configuration object, and specify:

   • configuration.card.showsHolderNameField: true. This shows the input field for the cardholder name.

3. If you want to set ThreeDSRequestorAppURL, create a configuration object and specify actionComponent.threeDS.requestorAppURL. Always use a universal link if you set ThreeDSRequestorAppURL.

   Copy code
   let configuration = DropInComponent.Configuration(apiContext: apiContext)
   configuration.card.showsHolderNameField = true // Shows the field for entering the holder name.
    
   configuration.actionComponent.threeDS.requestorAppURL = URL(string: "YOUR_APP_URL") // Optional, add a universal link here when you want to send ThreeDSRequestorAppURL

When the shopper is entering their card details, Drop-in tries to recognize the card brand. When successful, Drop-in renders the brand icon.

Make a payment

When the shopper proceeds to pay, Drop-in invokes the didSubmit method which contains data.paymentMethod.

1. Pass data.paymentMethod to your server.
2. From your server, make a /payments request, specifying:

Checkout API v69 and laterCheckout API v68 and earlierCheckout API v69 and laterCheckout API v68 and earlier

Parameter name	Required	Description
paymentMethod		The data.paymentMethod object from the didSubmit event from your client app.
paymentMethod.threeDS2SdkVersion		Required to trigger in-app native. See how to get the SDK version.
browserInfo		The shopper's browser information. Include the following fields to handle cases where the payment is routed to 3D Secure 2 redirect. acceptHeader: The accept header value of the shopper's browser. You can use a dummy value. userAgent: Get it using BrowserInfo.initialize .
paymentMethod.holderName	Required for Visa	The cardholder's name.
channel		Set to iOS.
nativeThreeDS		Set to preferred. Indicates that your payment page can handle 3D Secure 2 transactions natively.
returnUrl		Used to redirect the shopper back to a webpage for redirect and other payment flows. If you want to redirect the shopper to your app, configure a threeDSRequestorAppURL.
billingAddress		The cardholder's billing address.
shopperEmail	Required for Visa	The cardholder's email address. shopperEmail or a phone number is required for Visa.
threeDS2requestData.homePhone, threeDS2RequestData.workPhone or threeDS2RequestData.mobilePhone	Required for Visa	A phone number for the shopper, include one of these fields. shopperEmail or a phone number is required for Visa.

Get the SDK version

In your payment request, you must include the current SDK version. To get the SDK version:

NSString* threeDS2SDKVersion = ADY3DS2SDKVersion();
let threeDS2SDKVersion = ADY3DS2SDKVersion()

curl https://checkout-test.adyen.com/checkout/v69/payments \
-H 'x-api-key: ADYEN_API_KEY' \
-H 'content-type: application/json' \
-d '{
   "amount":{
      "currency":"EUR",
      "value":1000
   },
   "reference":"YOUR_ORDER_NUMBER",
   "shopperReference":"YOUR_UNIQUE_SHOPPER_ID",
   "paymentMethod": STATE_DATApaymentMethod field of an object passed from the client app. Return the fields as they are, sdkVersion is required to trigger native.,
   "authenticationData": {
      "threeDSRequestData": {
    	"nativeThreeDS": "preferred"
      }
   },
   "billingAddressstate.data.billingAddress from onSubmit": {
      "street": "Infinite Loop",
      "houseNumberOrName": "1",
      "postalCode": "1011DJ",
      "city": "Amsterdam",
      "country": "NL"
   },
   "browserInfoRequired for 3D Secure 1: {
      "userAgent":"Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A5370a Safari/604.1",
      "acceptHeader":"text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng,*\/*;q=0.8"
   },
   "shopperEmail":"s.hopper@example.com",
   "channel":"iOS",
   "returnUrl":"my-app://adyen",
   "merchantAccount":"YOUR_MERCHANT_ACCOUNT"
}'

Your next steps depend on whether the /payments response contains an action object, and on the action.type. Choose your API version:

{
    "action":{
        "type":"threeDS2",
        "subtype": "fingerprint",
        "paymentData":"Ab02b4c0!BQABAgCuZFJrQOjSsl\/zt+...",
        "paymentMethodType":"scheme",
        "authorisationToken" : "Ab02b4c0!BQABAgAvrX03p...",
        "token":"eyJ0aHJlZURTTWV0aG9kTm90aWZpY..."
    },
    "resultCode":"IdentifyShopper",
    ...
}

Submit the authentication result

If the action object in the /payments response contains threeDS2 (for Checkout API v67 and later), threeDS2Fingerprint, or threeDS2Challenge (for Checkout API v66 and earlier), submit the authentication result. Choose your API version:

Present the payment result

Use the  resultCode from the /payments or /payments/details response to present the payment result to your shopper. You will also receive the outcome of the payment asynchronously in a webhook.

For card payments, you can receive the following resultCode values:

Testing

Use our test card numbers to test how your integration handles different 3D Secure authentication scenarios.

Troubleshooting

If native 3D Secure 2 is not triggered, check that:

• Your Drop-in version is 4.10.2 or later.
• paymentMethod.threeDs2SdkVersion is populated and sent in payment request.
• channel is set to iOS.
• authenticationData.threeDSRequestData.nativeThreeDS is set to preferred if you use Checkout API v69 or later OR additionalData.allow3DS2 is set to true if you use Checkout API v68 or earlier.

See also