Defines Visa 3D Secure authentication flow, required request parameters, and post-authentication handling for Remote API transactions.

Visa 3D Secure

Overview

Visa 3D Secure introduces an additional authentication step during card processing. When enabled, transactions may be redirected to the card issuer’s authentication page before final authorization.

This section defines required request fields, response handling, and post-authentication processing behavior.

Required Request Fields

The following fields must be included when initiating a 3D Secure transaction:

Variable Requirement Type Max Size Possible Values / Example Description Notes
termurl Mandatory string N/A URL Merchant callback URL used after authentication. Must point to the merchant’s processing script endpoint.
tdsflag Mandatory string N/A 1 Enables 3D Secure processing for the transaction. Must be set to 1 to initiate 3D Secure flow.

Enrollment Requirement

  • Merchants must be enrolled in the 3D Secure program.
  • Additional fees may apply depending on the processor or gateway configuration.
  • Contact sales or technical support for activation details.

Authentication Flow

  1. If a 3D Secure–enabled card is used, the system returns all submitted variables along with additional response fields.

  2. If authentication is required, the response may include:

Variable Value Description
FinalStatus success, problem Indicates initial processing outcome.
success = authentication required or passed initial checks.
problem = transaction failed.
tdsauthreq Authentication request payload Contains the HTML or redirect payload for the issuer authentication page. Must be returned to the customer unchanged.

Authentication Redirect Handling

If tdsauthreq is returned with FinalStatus=success:

  • The merchant must return the tdsauthreq content to the customer without modification.
  • This redirects the customer to the issuing bank’s authentication page.
  • The customer completes authentication by entering their 3D Secure password.

Post-Authentication Processing

After authentication is completed, the processor sends a POST request to the URL specified in termurl.

Depending on the 3D Secure provider, the request may include one of the following identifiers:

Variable Value Notes
MD wirecard3ds Returned only for Wirecard-based 3D Secure transactions.
OrderID firstatl,{account},{transaction orderID} Returned only for First Atlantic integrations.

Final Authorization Step

  • All name/value pairs received in the post-authentication request must be forwarded to the primary payment endpoint (pnpremote.cgi).
  • The gateway response to this second request follows the standard Response Fields specification.
  • The transaction is finalized as a standard Remote Authorization once processing completes.

Notes

  • The 3D Secure flow introduces a two-step authorization process.
  • The second authorization request is treated identically to a non-3D Secure transaction once authentication is complete.