Scheme passkeys

Use scheme passkeys to let returning shoppers authenticate online card payments with device biometrics or a PIN code.

Limited availability
Scheme passkeys are currently in pilot phase, and only enabled for a specific group of merchants. If you want to be included in this group, reach out to your Adyen contact.

Scheme passkey authentication is a form of Strong Customer Authentication (SCA) that allows returning shoppers to authenticate online card payments with a PIN code, or their registered biometrics, such as a fingerprint or facial recognition.

On their first transaction, the shopper completes a standard SCA challenge with their card issuer and registers a passkey on their device. For all future purchases using their saved card, the shopper authenticates instantly using their device passkey, instead of completing a new SCA challenge. This avoids a redirect to the shopper's card issuer for a 3D Secure challenge.

By reducing challenge friction, scheme passkey authentication can help improve payment conversion. When the authentication is successful, scheme passkey authentication also provides a liability shift from your company to the issuer.

Requirements

Requirement	Description
Integration type	An Adyen online payments integration that uses Adyen to authenticate and authorize payments.
Limitations	You cannot enforce scheme passkey authentication as the authentication method on a transaction. The Authentication Engine automatically selects the scheme passkey flow only if it is the most optimal authentication method for the transaction. Scheme passkey authentication is only supported if you use Adyen for both authentication and authorization. Scheme passkey authentication is not supported if the redirect URL opens in an iFrame. Scheme passkey authentication is currently not supported for recurring Merchant Initiated Transactions (MIT), such as subscriptions or unscheduled card-on-file payments where the recurringProcessingModel is set to Subscription or UnscheduledCardOnFile. Scheme passkey authentication is eligible for Mastercard transactions only if your integration supports network tokenization.
Setup steps	You must support the redirect flow for 3D Secure 2 authentication: Sessions flow : 3D Secure 2 support is built-in. You must set the nativeThreeDS to disabled in your POST /sessions request. Advanced flow : Implement redirect 3D Secure 2 and make sure you send in the applicable 3D Secure 2 parameters for your integration type in your POST /payments request. Add the payment methods that you want to accept in your Customer Area. You must reach out to your account manager if you want to test the shopper experience for scheme passkey authentication in the TEST environment.

How scheme passkey authentication works

The scheme passkey authentication flow depends on whether the shopper is making their first purchase on your website, or if they are a returning shopper.

First purchase

When a first-time shopper proceeds to check out with a card:

The shopper enters their card details.
You make a payment request using your 3D Secure 2 Redirect integration.
- Sessions flow : 3D Secure 2 support is built-in. You must set the nativeThreeDS to disabled in your POST /sessions request.
- Advanced flow : Implement redirect 3D Secure 2 and make sure you send in the applicable 3D Secure 2 parameters for your integration type in your POST /payments request.
The Authentication Engine determines that the transaction requires a challenge. The shopper is presented with a 3D Secure 2 authentication challenge to verify their identity.
If the shopper completes the 3D Secure 2 challenge successfully, Adyen presents the option to create a passkey.
The shopper creates a passkey by registering their biometric data.
The passkey is saved on the shopper's device, and can be used to authenticate future transactions with the same device and card.
Adyen continues the payment flow.

Returning shopper

When the shopper returns for a subsequent transaction with the same device and card:

You make a payment request using your 3D Secure 2 Redirect integration.
- Sessions flow : 3D Secure 2 support is built-in. You must set the nativeThreeDS to disabled in your POST /sessions request.
- Advanced flow : Implement redirect 3D Secure 2 and make sure you send in the applicable 3D Secure 2 parameters for your integration type in your POST /payments request.
The Authentication Engine determines that the transaction requires a challenge and chooses the most optimal authentication method based on eligibility.
1. If scheme passkey authentication is the most optimal authentication method, the shopper is presented with the option to authenticate using their registered passkey.
2. If scheme passkey authentication is not eligible, or is not the most optimal authentication method, Adyen selects another authentication method, such as 3D Secure 2.
If the authentication is successful, Adyen continues the payment flow.

Eligibility

When the shopper makes a payment request, Adyen checks if scheme passkey authentication is an eligible authentication method for the transaction. The eligibility depends on the following criteria:

Criterion	Description
Supported devices and browsers	Supported operating system: All operating systems Supported browsers: Google Chrome (version 67+) Mozilla Firefox (version 60+) Apple Safari (version 13+) Microsoft Edge (version 18+) Supported devices: all devices that support WebAuthn.
Supported payment methods	Scheme passkey authentication is supported for Mastercard network tokenized transactions.
Supported payment flows	Scheme passkey authentication is supported for all payments with `shopperInteraction` set to Ecommerce. For recurring payments, Scheme passkey authentication is supported for all Customer Initiated Transactions (CIT). Scheme passkey authentication is not supported for recurring Merchant Initiated Transactions (MIT), such as subscriptions.
Regional availability	Scheme passkey authentication is currently available in the UK and the EEA.

Liability shift

A successful scheme passkey authentication can shift liability for transactions from your company to the issuer.

Every transaction authenticated with 3D Secure 2 receives an Electronic Commerce Indicator (ECI) value that indicates the state of the authentication and determines whether liability can be shifted to the issuer.

The final liability shift outcome is determined after authorization. A card scheme can downgrade a payment's liability shift during authorization, even if the ECI value indicated a liability shift during authentication.

Liability shift does not prevent a shopper from raising a dispute or chargeback. For more information, see 3D Secure liability shift rules.