Skip to main content
3D Secure is targeted for release at the end of November 2026. The flow below describes the API as it will ship; endpoint details and the reference pages will be added at launch. For the Widget, 3DS will be enabled without changes on your side.
3D Secure (3DS) authenticates online card transactions using the EMV® 3-D Secure protocol, protecting cardholders, merchants and issuers against fraud.

​
The flow

1

Create a card token

Generate a one-time-use token for the customer’s card details.
2

Device data collection

Send a request to the device-data endpoint to get the JWT, URL and BIN for the Device Data Collection (DDC) form, embed the form in a hidden iframe, and wait for the profile.completed postMessage from the card scheme’s DDC host.
3

Authenticate

Send the authentication request. The response is either authenticated (pass the authenticationValue straight to the payment) or a challenge (display the issuer’s challenge iframe to the customer, then use the challenge reference).
4

Authorise

Complete the payment with the data from the previous steps.

​
What to expect at launch

  • The DDC and challenge forms post to the card scheme’s hosts (centinelapistag.cardinalcommerce.com for test, centinelapi.cardinalcommerce.com for production); verify postMessage origins against those.
  • JWTs are valid for 10 minutes. Form field names are uppercase (JWT, Bin, MD).
  • The challenge iframe should be sized to the challenge.windowSize you requested, defaulting to 400×500.
If you’d like early access to the sandbox implementation, contact support@paychoice.com.au.