--- title: "Authentication" description: "Learn how Adyen optimizes the authentication process for online card payments." url: "https://docs.adyen.com/online-payments/authentication" source_url: "https://docs.adyen.com/online-payments/authentication.md" canonical: "https://docs.adyen.com/online-payments/authentication" last_modified: "2026-09-18T12:57:09+02:00" language: "en" --- # Authentication Learn how Adyen optimizes the authentication process for online card payments. Strong customer authentication (SCA) requires shoppers to verify their identity for card-not-present transactions. This can reduce fraud and fraudulent chargebacks. Successful authentication can also result in a liability shift from you to the issuer. In some regions and markets, regulations mandate SCA, including PSD2 in the EEA and the Payment Services Regulations 2017 in the UK. In markets without an SCA mandate, issuers can still use authentication data to assess transaction risk. To support these requirements, you can implement authentication in your regular payment flow. This lets shoppers complete authentication when it is required and lets Adyen use the authentication result when it processes the payment. You can then optimize the authentication flow to reduce unnecessary checkout friction. ## Optimize the authentication flow Adyen offers the following features to optimize the authentication flow: * **[Dynamic 3D Secure](/risk-management/dynamic-3d-secure)** and **[risk-based authentication](/risk-management/dynamic-3d-secure#risk-based-authentication)**: Evaluates transaction risk to determine whether to request a challenge. When you use Protect premium, real-time risk signals, machine learning rules, and your custom risk rules inform this assessment. High-risk transactions can require shopper authentication, while low-risk transactions can qualify for an exemption or frictionless authentication. * [**Authentication Engine** ](#authentication-engine): Selects the most appropriate authentication method, such as 3D Secure 2, scheme passkey authentication, or Google Secure Payment Authentication (Google SPA). It considers device capabilities, risk signals, issuer data, real-time performance data, and local regulatory requirements. The Authentication Engine also optimizes the data and the shopper experience for 3D Secure flows to increase issuer acceptance and reduce unnecessary challenges. * [**Adyen Uplift** ](/uplift): Analyzes authorization rates and payment performance, then provides targeted recommendations. For example, it can identify missing integration data, recommend experiments, or suggest features that can increase frictionless authentication and ultimately boost conversion. You can combine these features to optimize the authentication flow. This helps to reduce shopper friction during checkout, and improves the overall checkout experience by preventing soft declines and improving authentication rates. ## Requirements | Requirement | Description | | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Integration type** | [An online payments integration](/online-payments/build-your-integration). | | **Limitations** | Including certain parameters in your payment request overrides Adyen's authentication decisions, reducing our ability to optimize the authentication flow. To use the optimized flow, ensure that you do not send the following parameters in your request.- [authenticationData.attemptAuthentication](https://docs.adyen.com/api-explorer/Checkout/latest/post/payments#request-authenticationData-attemptAuthentication) - [threeDS2RequestData.threeDSRequestorChallengeInd](https://docs.adyen.com/api-explorer/Checkout/latest/post/payments#request-3DS2RequestData-threeDSRequestorChallengeInd) - [scaExemption](https://docs.adyen.com/api-explorer/Checkout/latest/post/payments#request-additionalData-listOfValues-scaExemption) - [threeDSVersion](https://docs.adyen.com/api-explorer/Checkout/latest/post/payments#request-additionalData-listOfValues-threeDSVersion) | | **Setup steps** | To use the Authentication Engine, make sure that you:- Support the redirect flow for 3D Secure 2 authentication: * [**Sessions flow** ](/online-payments/build-your-integration/sessions-flow): 3D Secure 2 support is built-in. You must set the [nativeThreeDS](https://docs.adyen.com/api-explorer/Checkout/latest/post/sessions#request-authenticationData-threeDSRequestData-nativeThreeDS) to **disabled** in your POST [/sessions](https://docs.adyen.com/api-explorer/Checkout/latest/post/sessions) request. * [**Advanced flow** ](/online-payments/build-your-integration/advanced-flow): [Implement redirect 3D Secure 2](/online-payments/3d-secure/redirect-3ds2) and make sure you send in the [applicable 3D Secure 2 parameters](/online-payments/3d-secure/api-reference#3d-secure-2-additional-data-objects) for your integration type in your POST [/payments](https://docs.adyen.com/api-explorer/Checkout/latest/post/payments) request. - Add the [payment methods that you want to accept](/payment-methods/add-payment-methods) in your [Customer Area](https://ca-test.adyen.com/). | ## How an optimized authentication flow works The following steps show how an optimized authentication flow works, when you combine Adyen's authentication features: 1. You make a payment request with the shopper's card details. To use the Authentication Engine, the request must support the redirect flow for 3D Secure 2 authentication. * [**Sessions flow** ](/online-payments/build-your-integration/sessions-flow): 3D Secure 2 support is built-in. You must set the [nativeThreeDS](https://docs.adyen.com/api-explorer/Checkout/latest/post/sessions#request-authenticationData-threeDSRequestData-nativeThreeDS) to **disabled** in your POST [/sessions](https://docs.adyen.com/api-explorer/Checkout/latest/post/sessions) request. * [**Advanced flow** ](/online-payments/build-your-integration/advanced-flow): [Implement redirect 3D Secure 2](/online-payments/3d-secure/redirect-3ds2) and make sure you send in the [applicable 3D Secure 2 parameters](/online-payments/3d-secure/api-reference#3d-secure-2-additional-data-objects) for your integration type in your POST [/payments](https://docs.adyen.com/api-explorer/Checkout/latest/post/payments) request. 2. Adyen uses Dynamic 3D Secure and risk-based authentication to evaluate the transaction and determine whether it needs a challenge based on issuer requirements. The following table explains the results tied to Adyen's risk evaluations: | Transaction risk | Result | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Low | Low risk transactions go through one of the following flows:- PSD2 exemption: the transaction is exempt from PSD2 requirements. - Frictionless 3D Secure 2: the acquirer, issuer, and card scheme exchange all necessary information in the background through passive authentication using the shopper's device fingerprint. - 3D Secure 2 data-only: you share the shopper data with the scheme directly, who then handles the authentication. | | High | High risk transactions go through the challenge flow. The shopper must verify their identity by completing a Strong Customer Authentication (SCA) challenge using one of Adyen's [authentication methods](#authentication-methods). The Authentication Engine automatically selects the best method based on factors such as the shopper's browser, the payment method, and other criteria. | | Very high | Very high risk transactions are declined entirely. | 3. Adyen Uplift analyzes your transactions and provides insights and targeted recommendations to optimize your authentication flow and conversion rates. ## Authentication Engine When Strong Customer Authentication (SCA) or identity verification is required for a transaction, Adyen offers three ways in which the shopper can authenticate. If the authentication is successful, You reduce the chance of fraud, and the liability shifts to the issuer. The Authentication Engine automatically selects the best method based on factors such as the shopper's browser, the payment method, and other eligibility criteria. | Authentication method | Description | Supported channels | Shopper experience | | ----------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- | ------------------------------------------------------------------------------ | | [**Google Secure Payment Authentication (Google SPA)**](/online-payments/authentication/google-secure-payment-authentication) | Google Secure Payment Authentication (Google SPA) is a method of authentication that uses Google's security features to verify the identity of the shopper. | Chrome / Android | Biometric verification integrated directly into Google Wallet/Chrome. | | [**Scheme passkeys**](/online-payments/authentication/scheme-passkeys) | Scheme passkeys are a method of authentication that uses the shopper's device to verify their identity. | Web / Mobile Redirect | One-time 3D Secure 2 registration. Subsequent checkouts use device biometrics. | | [**3D Secure 2**](/online-payments/3d-secure) | 3D Secure 2 is a method of authentication that uses the shopper's device to verify their identity. | Web, iOS, Android | Standard issuer web view, SMS OTP, or bank app push notification. | During the payment process, the Authentication Engine automatically selects the best method based on factors such as the shopper's browser, the payment method, and other eligibility criteria. After the shopper successfully completes the challenge, the payment is authorized. ## Next steps [required](/online-payments/3d-secure) ### [3D Secure 2](/online-payments/3d-secure) [Verification using an SMS or notification on the shopper's device.](/online-payments/3d-secure) ### [Google Secure Payment Authentication](/online-payments/authentication/google-secure-payment-authentication) [Biometric verification integrated directly into Google Wallet/Chrome.](/online-payments/authentication/google-secure-payment-authentication) ### [Scheme passkeys](/online-payments/authentication/scheme-passkeys) [Checkout using registered passkey biometrics.](/online-payments/authentication/scheme-passkeys)