Hosted Payment Page

Overview

If you are integrating into our Hosted Payment Page (HPP) we will handle a lot of the steps required to authenticate your customers as detailed in ourEMV® 3-D Secure (v2) guides.

This developer documentation focuses on integrating 3-D Secure as well as ensure there is no effect on your PCI compliance responsibilities – keeping you in-scope for SAQ A.

By completing this integration guide, you will cater for all scenarios and be SCA ready.

Request

As you will see in the HPP Documentation we've marked which additional parameters are required for EMV® 3-D Secure (v2).

To save you needing to go take a closer look, here is a summary:

Make sure you have set the is_tds parameter as 2 to let us know you want to use 3-D Secure.

It is best practice to send on additional customer data the issuing bank will need to authenticate the cardholder. This consists of:

• The cardholder's billing address (billing_street, billing_city, billing_zipcode and billing_country_code_iso2).
• The cardholders' contact details (billing_email).
• A link to the "Contact Us" page on your website (merchant_contact_url).

In case it is EMV® 3-D Secure (v2), we need to know some additional settings / preferences you have for the authentication (tds_source, tds_type and tds_preference).

Once we have all of this information, we can handle any scenario that pops up.

Template

As you will see in the API documentation for EMV® 3-D Secure (v2) there are a few extra steps required to complete authentication including:

• Checking the version of 3-D Secure supported by the card issuer.
• Gathering the Device ID via the method_url.
• Gathering the user's browser data.

We've added all these actions to our acquired.js file in the default HPP template (which you can get from the Hub) to ensure everything works as it should.

Authentication

In the event that there is a ‘challenge’, we will display the issuer's ACS page to the user in order to complete the authentication - nothing you need to do here.

Response

Once authentication is complete, we'll respond back to you in your chosen method but there are some additional response codes / fields you should be aware of: