Strong authentication,
frictionless by default.
EMV 3-D Secure authentication for issuers and acquirers, engineered for frictionless flows and regulatory compliance across markets. Q3DS runs the full EMV 3-D Secure flow so acquirers meet SCA mandates and issuers control their risk — while the overwhelming majority of genuine payers are authenticated without ever seeing a challenge screen.
A certified 3-D Secure server, end to end.
Everything an acquirer or issuer needs to run EMV 3-D Secure in production — protocol, frictionless flows, challenge orchestration and the evidence to hold liability shift.
EMV 3DS protocol
Full AReq/ARes and CReq/CRes message handling on current EMV 3-D Secure specifications, for browser and app-based flows across the major card schemes.
Frictionless flows
Rich device and transaction data lets issuers approve low-risk authentications silently. Most payers complete 3DS without noticing it happened — and conversion stays intact.
Challenge orchestration
When a challenge is warranted, Q3DS renders issuer-branded OTP, biometric or in-app approval steps that work cleanly inside checkout — no jarring redirects to unstyled pages.
Liability shift
Successfully authenticated transactions shift fraud chargeback liability from merchant to issuer. Q3DS records the CAVV and ECI evidence you need to hold that shift in disputes.
Regulatory compliance
Meets PSD2 SCA in Europe and equivalent strong-authentication mandates in Africa, Asia and the Gulf — with exemption handling for low-value, recurring and trusted-beneficiary cases.
Authentication analytics
Per-BIN and per-issuer dashboards show frictionless rates, challenge success and abandonment — so you can spot the issuers hurting your funnel and act on data.
Security that pays for itself.
Authentication done well is not a tax on conversion — it removes fraud losses and chargeback fees while keeping approval rates high. Q3DS is engineered to keep the challenge rate as low as issuers allow.
- Frictionless by defaultRich device and transaction data lets issuers approve low-risk payers silently.
- ECI 05 — fully authenticatedA cryptographic authentication value rides the authorization for approval uplift.
- Liability shifted to the issuerFraud chargebacks on authenticated transactions come off your books.
When a step-up is warranted, keep the payer in flow.
The minority of transactions that need a challenge shouldn't feel like a dead end. Q3DS renders issuer-branded OTP, biometric and in-app approval steps inside your checkout — and records the proof either way.
The 3DS handshake in three steps.
Authentication request
At checkout, Q3DS gathers device data and sends the AReq to the issuer's ACS with full transaction context.
Risk decision
The issuer scores the request. Low risk authenticates frictionlessly; higher risk triggers a branded challenge to the payer.
Proof attached
The cryptographic authentication value travels with the authorization — earning approval-rate uplift and liability shift.
One call to authenticate a payment.
Create an authentication session with the card, amount and transaction reference. Q3DS returns the ECI, CAVV and liability-shift verdict — or an ACS URL when the payer must be challenged. Test mode is a full sandbox whose OTP is always 1234.
POST /api/v1/q3ds/authentications
Authorization: Bearer sk_test_…
{
"number": "4111 1111 1111 1111",
"exp_month": 12,
"exp_year": 2029,
"amount_minor": 250000,
"currency": "NGN",
"transaction_reference": "TXN-8F21A6",
"device_channel": "browser"
}
200 OK
{
"status": "authenticated",
"eci": "05",
"cavv": "jJ81HADVRtXfCBAT…",
"three_ds_version": "2.2.0",
"liability_shift": true
}
Pair authentication with the rest of your defences.
Bring bank-grade authentication to your checkout.
Whether you're an acquirer meeting a mandate or an issuer standing up an ACS, our team maps the fastest path to production.