I'm trying to integrate cybersource payer authentication for my web app. After the setup payer auth request and cardinal cruise data collection iframe are completed, I get the ref number and I send that to /risk/v1/authentications to check the payer auth enrollment. But I never get the step-up URL to redirect the customer for otp. I always get, "challengeRequired": "N" response for all the 3ds testing cards. Can anyone help me with this? Thanks.
Here is the request payload:
{
"clientReferenceInformation": {
"code": "1687150893566"
},
"orderInformation": {
"amountDetails": {
"currency": "USD",
"totalAmount": "2160"
},
"billTo": {"address1": "1 Market St","address2": "Address 2","administrativeArea": "CA","country": "US","locality": "san francisco","firstName": "John","lastName": "Doe","phoneNumber": "4158880000","email": "[email protected]","postalCode": "94105"}}, "paymentInformation": {
"card": {
"expirationMonth": "01",
"expirationYear": "2026",
"number": "5200000000001096"
}
},
"consumerAuthenticationInformation": {
"returnUrl": "https://master.d2ujgj4n2ay0ce.amplifyapp.com/",
"referenceId": "6bd4c575-43dd-4e59-accd-0b4cb9beddcc"
}
}
Here is the response payload:
{
"clientReferenceInformation": {
"code": "1687150893566"
},
"consumerAuthenticationInformation": {
"challengeRequired": "N",
"authenticationTransactionId": "RyQDKyiLvTsIXoONt2i0",
"strongAuthentication": {
"OutageExemptionIndicator": "0"
},
"token": "AxjzbwSTdIFZtk0sPtKZABICURzC5rNzpBLS8AxhXa0ky9GLCALUBcAADiOC",
"acsUrl": "https://0merchantacsstag.cardinalcommerce.com/MerchantACSWeb/creq.jsp",
"acsReferenceNumber": "Cardinal ACS",
"pareq": "eyJtZXNzYWdlVHlwZSI6IkNSZXEiLCJtZXNzYWdlVmVyc2lvbiI6IjIuMS4wIiwidGhyZWVEU1NlcnZlclRyYW5zSUQiOiI5NDI2ZjNjOC1lNWJjLTRiZGItYThkMi1jYzg3YWZhN2M1YmEiLCJhY3NUcmFuc0lEIjoiMjRiYjI0NmItMmJlMi00OGNiLWEzMjAtZmNjYTE1NmExZDUzIiwiY2hhbGxlbmdlV2luZG93U2l6ZSI6IjAyIn0",
"directoryServerTransactionId": "42bdad76-5f37-46cb-a106-3c74cd1d4183",
"veresEnrolled": "Y",
"threeDSServerTransactionId": "9426f3c8-e5bc-4bdb-a8d2-cc87afa7c5ba",
"acsOperatorID": "MerchantACS",
"specificationVersion": "2.1.0",
"acsTransactionId": "24bb246b-2be2-48cb-a320-fcca156a1d53"
},
"errorInformation": {
"reason": "CONSUMER_AUTHENTICATION_REQUIRED",
"message": "The cardholder is enrolled in Payer Authentication. Please authenticate the cardholder before continuing with the transaction."
},
"id": "6871509476766344204953",
"paymentInformation": {
"card": {
"bin": "520000",
"type": "MASTERCARD"
}
},
"status": "PENDING_AUTHENTICATION",
"submitTimeUtc": "2023-06-19T05:02:27Z"
}
Looks like you are dealing with the same kind of 3D Secure Payment Authentication hell I find myself in. In my case, there is a helpful demo at https://developer.cybersource.com/demo/index.htm for Flex & Payer Authentication.
I don't think you can get away with passing the plain text card number. I believe that would be a PCI no no and would require you to pass a bunch of PCI assessments and obtain a PCI Attestation of Compliance.
I had to pass the transient token generated by Flex in the setup and check enrollment operations to get them to work. The transient token was passed in the tokenInformation.transientToken field of both requests. In addition, I busted down the token that I got back from Flex to extract the card type to build up a paymentInformation.card object with only the card type from the Flex token, and the expiration month and year.
I notice that you are using the Mastercard 3D Secure 2.1.0 test card number. I have having problems with Mastercard w/ version 2.1.0. The step up iframe is just empty so I never get to enter the 1234 one-time password so it never loads my returnURL. However, it works much better with the 2.2.0 test number 5200000000002151.