Strong Customer Authentication

Strong Customer Authentication (SCA) is a European regulatory requirement that forces an extra identity check on many electronic payments. VINR decides when authentication is required, requests the right exemptions, and runs the 3D Secure challenge for you — so you write the same payments.create call whether or not a challenge ends up firing.

This page is informational and not legal advice; consult your compliance counsel for binding decisions.

What SCA requiresAskCopy

Under PSD2, a payment in the European Economic Area generally needs two of three independent authentication factors:

The rule applies when both the cardholder's bank and the merchant's acquirer are in the EEA. It covers most card payments and many bank-initiated flows, with a defined set of exemptions for low-risk or low-value transactions.

How VINR applies itAskCopy

You do not call a separate "authenticate" endpoint. VINR evaluates every eligible payment at creation time, attaches an exemption where one is justified, and escalates to a challenge only when the issuer requires it.

import { Vinr } from '@vinr/sdk';

const vinr = new Vinr({ secretKey: process.env.VINR_SECRET_KEY });

const payment = await vinr.payments.create({
  amount: 4900,            // €49.00 in minor units
  currency: 'EUR',
  description: 'Annual plan',
  returnUrl: 'https://yoursite.com/payment/complete',
  authentication: {
    // Optional. Defaults to "automatic" exemption handling.
    requestExemption: 'transaction_risk_analysis',
  },
});

// payment.authentication.status → "pending" | "required" | "succeeded"
//                                  | "failed" | "exempted"
// payment.checkoutUrl → hosted page; runs the challenge if "required"

When payment.authentication.status is required, the customer must complete a challenge on checkoutUrl before the charge can be captured. VINR surfaces the outcome on the payment object and in webhooks, so your server logic stays the same across exempted and challenged payments.

ExemptionsAskCopy

Exemptions let you skip the challenge while staying compliant — they protect conversion without weakening the rule. VINR requests them on your behalf based on the request and your risk profile.

The issuer is the final authority: it can accept or reject any requested exemption. If it rejects, VINR transparently falls back to a 3D Secure challenge — the liability shift stays with you for unauthenticated exemptions you requested, and shifts to the issuer once a challenge completes.

The 3D Secure flowAskCopy

3D Secure (3DS2) is the network protocol that carries the authentication. VINR drives it through the hosted checkout in three phases.

Verify the outcome server-side from the webhook rather than trusting the browser redirect alone:

const event = vinr.webhooks.verify(rawBody, req.headers['x-vinr-signature']);

switch (event.type) {
  case 'payment.completed':
    // Authentication passed (or was validly exempted) and funds captured.
    await fulfillOrder(event.data.metadata.orderId);
    break;
  case 'payment.authentication_failed':
    // Challenge abandoned or rejected — prompt the customer to retry.
    await flagForRetry(event.data.id);
    break;
}

Test the branches in sandbox with the standard cards: 4242 4242 4242 4242 succeeds frictionlessly, 4000 0000 0000 3220 forces a 3DS challenge, and 4000 0000 0000 0002 is declined.

Impact on conversionAskCopy

Every challenge adds friction, so the goal is to authenticate only when required. To keep approval rates high:

• Let VINR request exemptions — the default handling maximizes frictionless flows within your acquirer's fraud-rate budget.
• Authenticate once, reuse it — the first on-session charge of a subscription clears the way for recurring and merchant_initiated debits.
• Pass rich data — accurate billing details and email improve the issuer's risk score and the odds of a frictionless result.
• Handle soft declines — never treat an exemption rejection as a hard failure; the hosted page already retries with a challenge.

Next stepsAskCopy