{"title":"Scheme passkeys","category":"default","creationDate":1789729029,"content":"<p><span style=\"color: #0ABF53;\"><span style=\"font-size: 20px;\"><strong>Limited availability<\/strong><\/span><\/span><br \/>\nScheme passkeys are currently in pilot phase, and only enabled for a specific group of merchants. If you want to be included in this group, reach out to your Adyen contact.<\/p>\n<hr \/>\n<p>Scheme passkey authentication is a form of Strong Customer Authentication (SCA) that allows returning shoppers to authenticate online card payments with a PIN code, or their registered biometrics, such as a fingerprint or facial recognition.<\/p>\n<p>On their first transaction, the shopper completes a standard SCA challenge with their card issuer and registers a passkey on their device. For all future purchases using their saved card, the shopper authenticates instantly using their device passkey, instead of completing a new SCA challenge. This avoids a redirect to the shopper's card issuer for a 3D Secure challenge.<\/p>\n<p>By reducing challenge friction, scheme passkey authentication can help improve payment conversion. When the authentication is successful, scheme passkey authentication also provides a liability shift from your company to the issuer.<\/p>\n<h2>Requirements<\/h2>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">Requirement<\/th>\n<th style=\"text-align: left;\">Description<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"text-align: left;\"><strong>Integration type<\/strong><\/td>\n<td style=\"text-align: left;\">An Adyen online payments integration that uses Adyen to authenticate and authorize payments.<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Limitations<\/strong><\/td>\n<td style=\"text-align: left;\"><ul><li markdown=\"1\">You cannot enforce scheme passkey authentication as the authentication method on a transaction. The Authentication Engine automatically selects the scheme passkey flow only if it is the most optimal authentication method for the transaction.<\/li><li markdown=\"1\">Scheme passkey authentication is only supported if you use Adyen for both authentication and authorization.<\/li><li markdown=\"1\">Scheme passkey authentication is not supported if the redirect URL opens in an iFrame.<\/li><li markdown=\"1\">Scheme passkey authentication is currently not supported for recurring Merchant Initiated Transactions (MIT), such as <a href=\"\/online-payments\/tokenization\/make-token-payments#make-a-subscription-or-unscheduled-card-on-file-payment\">subscriptions or unscheduled card-on-file payments<\/a> where the  <a href=\"https:\/\/docs.adyen.com\/api-explorer\/Checkout\/latest\/post\/payments#request-recurringProcessingModel\" class=\"codeLabel  external-link no-image\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">recurringProcessingModel<\/a> is set to <strong>Subscription<\/strong> or <strong>UnscheduledCardOnFile<\/strong>.<\/li><li markdown=\"1\">Scheme passkey authentication is eligible for Mastercard transactions only if your integration supports <a href=\"\/online-payments\/network-tokenization\/\">network tokenization<\/a>.<\/li><\/ul><\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Setup steps<\/strong><\/td>\n<td style=\"text-align: left;\"><ul><li markdown=\"1\">You must support the redirect flow for 3D Secure 2 authentication:<ul><li><a href=\"\/online-payments\/build-your-integration\/sessions-flow\">\n  <strong>Sessions flow<\/strong>\n<\/a>: 3D Secure 2 support is built-in. You must set the  <a href=\"https:\/\/docs.adyen.com\/api-explorer\/Checkout\/latest\/post\/sessions#request-authenticationData-threeDSRequestData-nativeThreeDS\" class=\"codeLabel  external-link no-image\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">nativeThreeDS<\/a> to <span translate=\"no\"><strong>disabled<\/strong><\/span> in your POST  <a href=\"https:\/\/docs.adyen.com\/api-explorer\/Checkout\/latest\/post\/sessions\" class=\"codeLabel  external-link no-image\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">\/sessions<\/a> request.<\/li><li markdown=\"1\"><a href=\"\/online-payments\/build-your-integration\/advanced-flow\">\n  <strong>Advanced flow<\/strong>\n<\/a>: <a href=\"\/online-payments\/3d-secure\/redirect-3ds2\">Implement redirect 3D Secure 2<\/a> and make sure you send in the <a href=\"\/online-payments\/3d-secure\/api-reference#3d-secure-2-additional-data-objects\">applicable 3D Secure 2 parameters<\/a> for your integration type in your POST  <a href=\"https:\/\/docs.adyen.com\/api-explorer\/Checkout\/latest\/post\/payments\" class=\"codeLabel  external-link no-image\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">\/payments<\/a> request.<\/li><\/ul><\/li><li markdown=\"1\">Add the <a href=\"\/payment-methods\/add-payment-methods\">payment methods that you want to accept<\/a> in your <a href=\"https:\/\/ca-test.adyen.com\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" class=\"external-link no-image\">Customer Area<\/a>.<\/li><li markdown=\"1\">You must reach out to your account manager if you want to test the shopper experience for scheme passkey authentication in the TEST environment.<\/li><\/ul><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>How scheme passkey authentication works<\/h2>\n<p>The scheme passkey authentication flow depends on whether the shopper is making their first purchase on your website, or if they are a returning shopper.<\/p>\n<h3>First purchase<\/h3>\n<p>When a first-time shopper proceeds to check out with a card:<\/p>\n<ol>\n<li>The shopper enters their card details.<\/li>\n<li>You make a payment request using your 3D Secure 2 Redirect integration.\n<ul>\n<li><a href=\"\/online-payments\/build-your-integration\/sessions-flow\">\n  <strong>Sessions flow<\/strong>\n<\/a>: 3D Secure 2 support is built-in. You must set the  <a href=\"https:\/\/docs.adyen.com\/api-explorer\/Checkout\/latest\/post\/sessions#request-authenticationData-threeDSRequestData-nativeThreeDS\" class=\"codeLabel  external-link no-image\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">nativeThreeDS<\/a> to <strong>disabled<\/strong> in your POST  <a href=\"https:\/\/docs.adyen.com\/api-explorer\/Checkout\/latest\/post\/sessions\" class=\"codeLabel  external-link no-image\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">\/sessions<\/a> request.<\/li>\n<li><a href=\"\/online-payments\/build-your-integration\/advanced-flow\">\n  <strong>Advanced flow<\/strong>\n<\/a>: <a href=\"\/online-payments\/3d-secure\/redirect-3ds2\">Implement redirect 3D Secure 2<\/a> and make sure you send in the <a href=\"\/online-payments\/3d-secure\/api-reference#3d-secure-2-additional-data-objects\">applicable 3D Secure 2 parameters<\/a> for your integration type in your POST  <a href=\"https:\/\/docs.adyen.com\/api-explorer\/Checkout\/latest\/post\/payments\" class=\"codeLabel  external-link no-image\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">\/payments<\/a> request.<\/li>\n<\/ul><\/li>\n<li>The Authentication Engine determines that the transaction requires a challenge. The shopper is presented with a 3D Secure 2 authentication challenge to verify their identity.<\/li>\n<li>If the shopper completes the 3D Secure 2 challenge successfully, Adyen presents the option to create a passkey.<\/li>\n<li>The shopper creates a passkey by registering their biometric data.<\/li>\n<li>The passkey is saved on the shopper's device, and can be used to authenticate future transactions with the same device and card.<\/li>\n<li>Adyen continues the payment flow.<\/li>\n<\/ol>\n<h3>Returning shopper<\/h3>\n<p>When the shopper returns for a subsequent transaction with the same device and card:<\/p>\n<ol>\n<li>You make a payment request using your 3D Secure 2 Redirect integration.\n<ul>\n<li><a href=\"\/online-payments\/build-your-integration\/sessions-flow\">\n  <strong>Sessions flow<\/strong>\n<\/a>: 3D Secure 2 support is built-in. You must set the  <a href=\"https:\/\/docs.adyen.com\/api-explorer\/Checkout\/latest\/post\/sessions#request-authenticationData-threeDSRequestData-nativeThreeDS\" class=\"codeLabel  external-link no-image\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">nativeThreeDS<\/a> to <strong>disabled<\/strong> in your POST  <a href=\"https:\/\/docs.adyen.com\/api-explorer\/Checkout\/latest\/post\/sessions\" class=\"codeLabel  external-link no-image\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">\/sessions<\/a> request.<\/li>\n<li><a href=\"\/online-payments\/build-your-integration\/advanced-flow\">\n  <strong>Advanced flow<\/strong>\n<\/a>: <a href=\"\/online-payments\/3d-secure\/redirect-3ds2\">Implement redirect 3D Secure 2<\/a> and make sure you send in the <a href=\"\/online-payments\/3d-secure\/api-reference#3d-secure-2-additional-data-objects\">applicable 3D Secure 2 parameters<\/a> for your integration type in your POST  <a href=\"https:\/\/docs.adyen.com\/api-explorer\/Checkout\/latest\/post\/payments\" class=\"codeLabel  external-link no-image\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">\/payments<\/a> request.<\/li>\n<\/ul><\/li>\n<li>The Authentication Engine determines that the transaction requires a challenge and chooses the most optimal authentication method based on <a href=\"#eligibility\">eligibility<\/a>.\n<ol>\n<li>If scheme passkey authentication is the most optimal authentication method, the shopper is presented with the option to authenticate using their registered passkey.<\/li>\n<li>If scheme passkey authentication is not eligible, or is not the most optimal authentication method, Adyen selects another authentication method, such as 3D Secure 2.<\/li>\n<\/ol><\/li>\n<li>If the authentication is successful, Adyen continues the payment flow.<\/li>\n<\/ol>\n<h2>Eligibility<\/h2>\n<p>When the shopper makes a payment request, Adyen checks if scheme passkey authentication is an eligible authentication method for the transaction. The eligibility depends on the following criteria:<\/p>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\"><strong>Criterion<\/strong><\/th>\n<th style=\"text-align: left;\"><strong>Description<\/strong><\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"text-align: left;\"><strong>Supported devices and browsers<\/strong><\/td>\n<td style=\"text-align: left;\">Supported operating system: All operating systems <br><br>Supported browsers:<ul><li markdown=\"1\">Google Chrome (version 67+)<\/li><li markdown=\"1\">Mozilla Firefox (version 60+)<\/li><li markdown=\"1\">Apple Safari (version 13+)<\/li><li markdown=\"1\">Microsoft Edge (version 18+)<\/li><\/ul><br>Supported devices: all devices that support <a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/API\/Web_Authentication_API\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" class=\"external-link no-image\">WebAuthn<\/a>.<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Supported payment methods<\/strong><\/td>\n<td style=\"text-align: left;\">Scheme passkey authentication is supported for Mastercard network tokenized transactions.<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Supported payment flows<\/strong><\/td>\n<td style=\"text-align: left;\">Scheme passkey authentication is supported for all payments with <code>shopperInteraction<\/code> set to <strong>Ecommerce<\/strong>. For <a href=\"\/online-payments\/tokenization\/make-token-payments\">recurring payments<\/a>, Scheme passkey authentication is supported for all Customer Initiated Transactions (CIT). Scheme passkey authentication is not supported for recurring Merchant Initiated Transactions (MIT), such as subscriptions.<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Regional availability<\/strong><\/td>\n<td style=\"text-align: left;\">Scheme passkey authentication is currently available in the UK and the EEA.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Liability shift<\/h2>\n<p>A successful scheme passkey authentication can shift liability for transactions from your company to the issuer.<\/p>\n<p>Every transaction authenticated with 3D Secure 2 receives an Electronic Commerce Indicator (ECI) value that indicates the state of the authentication and determines whether liability can be shifted to the issuer.<\/p>\n<p>The final liability shift outcome is determined after authorization. A card scheme can downgrade a payment's liability shift during authorization, even if the ECI value indicated a liability shift during authentication.<\/p>\n<p>Liability shift does not prevent a shopper from raising a dispute or chargeback. For more information, see <a href=\"\/online-payments\/3d-secure-for-regulation-compliance#3dsecurechargebackliabilityshiftrules\">3D Secure liability shift rules<\/a>.<\/p>\n<h2>See also<\/h2>\n<div class=\"see-also-links output-inline\" id=\"see-also\">\n<ul><li><a href=\"\/online-payments\/authentication\"\n                        target=\"_self\"\n                        >\n                    Authentication\n                <\/a><\/li><li><a href=\"\/online-payments\/3d-secure\/redirect-3ds2\"\n                        target=\"_self\"\n                        >\n                    Redirect 3D Secure 2\n                <\/a><\/li><li><a href=\"\/online-payments\/3d-secure-for-regulation-compliance\"\n                        target=\"_self\"\n                        >\n                    3D Secure for regulation compliance\n                <\/a><\/li><\/ul><\/div>\n","url":"https:\/\/docs.adyen.com\/online-payments\/authentication\/scheme-passkeys","articleFields":{"description":"Use scheme passkeys to let returning shoppers authenticate online card payments with device biometrics or a PIN code.","feedback_component":true,"filters_component":false},"algolia":{"url":"https:\/\/docs.adyen.com\/online-payments\/authentication\/scheme-passkeys","title":"Scheme passkeys","content":"Limited availability\nScheme passkeys are currently in pilot phase, and only enabled for a specific group of merchants. If you want to be included in this group, reach out to your Adyen contact.\n\nScheme passkey authentication is a form of Strong Customer Authentication (SCA) that allows returning shoppers to authenticate online card payments with a PIN code, or their registered biometrics, such as a fingerprint or facial recognition.\nOn their first transaction, the shopper completes a standard SCA challenge with their card issuer and registers a passkey on their device. For all future purchases using their saved card, the shopper authenticates instantly using their device passkey, instead of completing a new SCA challenge. This avoids a redirect to the shopper's card issuer for a 3D Secure challenge.\nBy reducing challenge friction, scheme passkey authentication can help improve payment conversion. When the authentication is successful, scheme passkey authentication also provides a liability shift from your company to the issuer.\nRequirements\n\n\n\nRequirement\nDescription\n\n\n\n\nIntegration type\nAn Adyen online payments integration that uses Adyen to authenticate and authorize payments.\n\n\nLimitations\nYou cannot enforce scheme passkey authentication as the authentication method on a transaction. The Authentication Engine automatically selects the scheme passkey flow only if it is the most optimal authentication method for the transaction.Scheme passkey authentication is only supported if you use Adyen for both authentication and authorization.Scheme passkey authentication is not supported if the redirect URL opens in an iFrame.Scheme passkey authentication is currently not supported for recurring Merchant Initiated Transactions (MIT), such as subscriptions or unscheduled card-on-file payments where the  recurringProcessingModel is set to Subscription or UnscheduledCardOnFile.Scheme passkey authentication is eligible for Mastercard transactions only if your integration supports network tokenization.\n\n\nSetup steps\nYou must support the redirect flow for 3D Secure 2 authentication:\n  Sessions flow\n: 3D Secure 2 support is built-in. You must set the  nativeThreeDS to disabled in your POST  \/sessions request.\n  Advanced flow\n: Implement redirect 3D Secure 2 and make sure you send in the applicable 3D Secure 2 parameters for your integration type in your POST  \/payments request.Add the payment methods that you want to accept in your Customer Area.You must reach out to your account manager if you want to test the shopper experience for scheme passkey authentication in the TEST environment.\n\n\n\nHow scheme passkey authentication works\nThe scheme passkey authentication flow depends on whether the shopper is making their first purchase on your website, or if they are a returning shopper.\nFirst purchase\nWhen a first-time shopper proceeds to check out with a card:\n\nThe shopper enters their card details.\nYou make a payment request using your 3D Secure 2 Redirect integration.\n\n\n  Sessions flow\n: 3D Secure 2 support is built-in. You must set the  nativeThreeDS to disabled in your POST  \/sessions request.\n\n  Advanced flow\n: Implement redirect 3D Secure 2 and make sure you send in the applicable 3D Secure 2 parameters for your integration type in your POST  \/payments request.\n\nThe Authentication Engine determines that the transaction requires a challenge. The shopper is presented with a 3D Secure 2 authentication challenge to verify their identity.\nIf the shopper completes the 3D Secure 2 challenge successfully, Adyen presents the option to create a passkey.\nThe shopper creates a passkey by registering their biometric data.\nThe passkey is saved on the shopper's device, and can be used to authenticate future transactions with the same device and card.\nAdyen continues the payment flow.\n\nReturning shopper\nWhen the shopper returns for a subsequent transaction with the same device and card:\n\nYou make a payment request using your 3D Secure 2 Redirect integration.\n\n\n  Sessions flow\n: 3D Secure 2 support is built-in. You must set the  nativeThreeDS to disabled in your POST  \/sessions request.\n\n  Advanced flow\n: Implement redirect 3D Secure 2 and make sure you send in the applicable 3D Secure 2 parameters for your integration type in your POST  \/payments request.\n\nThe Authentication Engine determines that the transaction requires a challenge and chooses the most optimal authentication method based on eligibility.\n\nIf scheme passkey authentication is the most optimal authentication method, the shopper is presented with the option to authenticate using their registered passkey.\nIf scheme passkey authentication is not eligible, or is not the most optimal authentication method, Adyen selects another authentication method, such as 3D Secure 2.\n\nIf the authentication is successful, Adyen continues the payment flow.\n\nEligibility\nWhen the shopper makes a payment request, Adyen checks if scheme passkey authentication is an eligible authentication method for the transaction. The eligibility depends on the following criteria:\n\n\n\nCriterion\nDescription\n\n\n\n\nSupported devices and browsers\nSupported operating system: All operating systems Supported browsers:Google Chrome (version 67+)Mozilla Firefox (version 60+)Apple Safari (version 13+)Microsoft Edge (version 18+)Supported devices: all devices that support WebAuthn.\n\n\nSupported payment methods\nScheme passkey authentication is supported for Mastercard network tokenized transactions.\n\n\nSupported payment flows\nScheme passkey authentication is supported for all payments with shopperInteraction set to Ecommerce. For recurring payments, Scheme passkey authentication is supported for all Customer Initiated Transactions (CIT). Scheme passkey authentication is not supported for recurring Merchant Initiated Transactions (MIT), such as subscriptions.\n\n\nRegional availability\nScheme passkey authentication is currently available in the UK and the EEA.\n\n\n\nLiability shift\nA successful scheme passkey authentication can shift liability for transactions from your company to the issuer.\nEvery transaction authenticated with 3D Secure 2 receives an Electronic Commerce Indicator (ECI) value that indicates the state of the authentication and determines whether liability can be shifted to the issuer.\nThe final liability shift outcome is determined after authorization. A card scheme can downgrade a payment's liability shift during authorization, even if the ECI value indicated a liability shift during authentication.\nLiability shift does not prevent a shopper from raising a dispute or chargeback. For more information, see 3D Secure liability shift rules.\nSee also\n\n\n                    Authentication\n                \n                    Redirect 3D Secure 2\n                \n                    3D Secure for regulation compliance\n                \n","type":"page","locale":"en","boost":17,"hierarchy":{"lvl0":"Home","lvl1":"Online payments","lvl2":"Authentication","lvl3":"Scheme passkeys"},"hierarchy_url":{"lvl0":"https:\/\/docs.adyen.com\/","lvl1":"https:\/\/docs.adyen.com\/online-payments","lvl2":"https:\/\/docs.adyen.com\/online-payments\/authentication","lvl3":"\/online-payments\/authentication\/scheme-passkeys"},"levels":4,"category":"Online Payments","category_color":"green","tags":["Scheme","passkeys"]}}
