Authentication (3DS)

Xendit supports 2 integration methods for performing Authentication for both 3DS and 3DS 2.0 (EMV 3DS) :

• Via xendit.js or SDK (Android SDK or iOS SDK). We generally recommend using our xendit.js or SDK libraries in order to integrate easily.
• Via API. This integration specifically use for PCI-DSS Level 1 certified merchant which can integrate with us using our PAN (Primary Account Number) integration to support you to charge card directly using card number or Xendit token depending on which suits your business needs. For PAN integration you can do the authentication process using our API contains of 2 process; Enrollment Check and 3DS Verification. API flow and guideline are provided on PAN docs that you can receive from your AM.

EMV 3DS - Frictionless

For frictionless authentication, it’s recommended to use xendit.js or SDK as the SDK has already handled the frictionless flow required by EMV 3DS, or else you will need to implement EMV 3DS frictionless flow and integration yourself. The difference between 3DS and 3DS 2.0 (EMV 3DS) is that for EMV 3DS, you can choose to provide additional data (such as billing_details or customer object) in the 3DS Authentication request to try and achieve frictionless authentication. This is not mandatory. If you do not provide any additional data, Xendit will still attempt to process 3DS as EMV 3DS even the frictionless is not attempted.

If you’re using Xendit tokens and performing Tokenization + 3DS using our xendit.js or SDK libraries, then the additional data must be provided in the Tokenization request. For additional data, Xendit recommends adding at least the billing_details so that frictionless authentication can happen for cards which support it

• billing_details object, containing
  • given_names
  • surname
  • email
  • mobile_number
  • phone_number
  • address
    • country
    • street_line1
    • street_line2
    • city province_state
    • postal_code

To comply with the latest Visa Mandate / Regulation, there are some parameters which will be used by the issuer to assess the 3DS authentication request, these parameters are the following:

• card_data object, containing
  • card_holder_first_name
  • card_holder_last_name
  • card_holder_email
  • card_holder_phone_number

If you have already created a multiple use token without these parameters, we highly recommend you to add these parameters in the 3DS authentication request.

Specific data params (see here for descriptions)

Demo Sample

You can use our demo page that’s using xendit.js [reference] for performing authentication:

• Tokenization and Authentication (bundled) for single use token and only performing tokenization for multi-use token (authentication will be separated)
• Authentication for performing authentication using multi-use token or full PAN information if you are PCI-DSS certified and allowed to use PAN integration
• Authentication with customizable currency field

If you have successfully performed EMV 3DS, then you should see the demo 3DS page looking like this

You can check our testing card list for EMV 3DS enabled cards to be used for demo.

Last Updated on 2024-11-21