How PCI Booking Handles 3D Secure
PCI Booking supports 3DS authentication in three ways, depending on how you capture cards:Hosted Card Entry Form with 3DS
When you capture a card directly from the cardholder using the Hosted Card Entry Form, enable 3DS in your merchant setup and PCI Booking triggers the 3DS2 challenge automatically during card capture. The cardholder completes authentication on the same page, and you receive the fully authenticated token in the callback.Store 3DS authentication from a third party
When you receive 3DS authentication data from a third party (for example, an OTA that has already verified the cardholder), use the Store 3DS Authentication endpoint to attach the 3DS result to an existing card token. The stored authentication data can then be used when processing a charge through the payment gateway.Tokenize in transit with 3DS data
When tokenizing card data in transit from a third party using Tokenization on Response or Tokenization on Request, PCI Booking preserves any 3DS authentication data alongside the token. This lets you charge the card with the original 3DS proof intact. To configure your 3DS merchant details, follow the 3DS Merchant Setup guide.Test Cards
Use these cards to test 3DS flows in your sandbox environment. For all cards below:- Expiry date: any future date
- Name on card:
Three DS test - CVV:
123
Frictionless
Cardholder is authenticated based on transaction data alone. No additional challenge is shown. You receive a fully authenticated 3DS result immediately.Device Fingerprint (DFP)
The issuer requests additional device information for risk analysis. The cardholder does not see any change in the flow.Challenge
The issuer requires a user challenge (OTP prompt).Device Fingerprint + Challenge
The issuer requests device information followed by a user challenge.Frequently asked questions
Does PCI Booking handle the 3DS challenge flow automatically?
Yes. When you use the Hosted Card Entry Form with 3DS enabled, PCI Booking manages the entire 3DS2 flow including device fingerprinting and challenges. Your system receives the final authentication result.Can I use 3DS with cards received from an OTA?
Yes. If the OTA has already completed 3DS authentication, you can store the authentication data alongside the card token using the Store 3DS Authentication endpoint.Related
- 3DS Merchant Setup. Configure merchant information for 3DS authentication.
- 3DS Auth Management. Store, retrieve, and delete 3DS data on tokens.
- Collect and Process a Payment. Full card capture and charge workflow with 3DS support.