How PCI Booking Handles 3D Secure
The SCA-relevant case for PSD2 is capturing the card directly from the cardholder: using the Hosted Card Entry Form, the entire integration is one parameter - addThreeDS=true to the request. PCI Booking triggers the 3DS2 challenge automatically during card capture, the cardholder authenticates in-session (satisfying SCA), and you receive the fully authenticated token in the callback. No call sequence or separate endpoint is needed for this path - in particular, store-3d-token is a different, unrelated endpoint (only for attaching a 3DS result obtained outside PCI Booking) and isn’t needed here.
PCI Booking also supports 3DS data arriving via other routes (a third party’s own MPI, or extracted in-transit from a Tokenization on Request/Response payload) - see 3DS Auth Management for the full set of ways 3DS data can end up on a token, and how it’s used automatically afterward.
To configure your 3DS merchant details, follow the 3DS Merchant Setup guide.
Test Cards
Use PCI Booking’s 3D Secure test cards to exercise all four authentication flows (frictionless, device fingerprint, challenge, and combined). The full card list with OTP codes is maintained in Testing and Going Live.Frequently asked questions
Does PCI Booking handle the 3DS challenge flow automatically?
Yes. When you use the Hosted Card Entry Form with 3DS enabled, PCI Booking manages the entire 3DS2 flow including device fingerprinting and challenges. Your system receives the final authentication result.Can I use 3DS with cards received from an OTA?
Yes. If the OTA has already completed 3DS authentication, you can store the authentication data alongside the card token using the Store 3DS Authentication endpoint.Related
- 3DS Merchant Setup. Configure merchant information for 3DS authentication.
- 3DS Auth Management. Store, retrieve, and delete 3DS data on tokens.
- Collect and Process a Payment. Full card capture and charge workflow with 3DS support.