Intereaction with 3D Secure [Документация Сбербанка]

Intereaction with 3D Secure

Internal MPI

Description:

1	The cardholder places an order on the merchant website (online store) and decides to pay for the goods with a bank card.
2	After the customer confirms the order, the store system registers the order in the payment gateway. Used for registration are such parameters as the amount to be debited, the currency of the debiting, the order number in the Store system, and the URL where the Customer is to be returned.
3	In case of a request for registration, the payment gateway returns a unique order identifier in the payment system and the URL to which it's needed to redirect the user to get the payment form.
4	The online store takes the cardholder's browser to its payment page to enter card data.
5	The cardholder enters their bank card details on the payment page of the online store and sends the data.
6	The merchant sends a payment request to the payment gateway. for payment, such parameters as the order number in the payment gateway (obtained in step 3), language, and card details are used: PAN, CVC, year and month of the card expiration date and the name of the cardholder.
7	Having received payment details (card number, etc.), the system checks whether the card is involved in 3-D Secure, including using the Directory Server.
8	The result of the check is sent to the Store: whether the card is enrolled, the URL of the ACS server of the Issuer where the Customer needs to be authenticated.
9	The store system sends a redirect to the issuer's ACS to the client's browser.
10	The cardholder (client) is authenticated with the issuer's ACS.
11	After authenticating the cardholder, the issuer's ACS redirects the client to the payment gateway while passing PARes. The payment gateway authorizes the order if the client is successfully authenticated on ACS, or rejects the pre-authorization if the client is not successfully authenticated on the ACS.
12	The client goes to the store page with the payment results.
13	The merchant sends a request for the payment status of the order to the payment gateway.
14	The payment gateway returns the result of order authorization to the store.
15	The store displays the page with the results of the order payment to the client.

Internal MPI, simplified redirection to ACS

The simplified redirect to ACS allows the merchant to organize client authentication using a simple redirect to the payment gateway page, specifying only the buyer's order number in the link part.

Description:

1	The cardholder places an order on the merchant website (online store) and decides to pay for the goods with a bank card.
2	After the customer confirms the order, the store system registers the order in the payment gateway. Used for registration are such parameters as the amount to be debited, the currency of the debiting, the order number in the Store system, and the URL where the Customer is to be returned.
3	In case of a request for registration, the payment gateway returns a unique order identifier in the payment system and the URL to which it's needed to redirect the user to get the payment form.
4	The online store takes the cardholder's browser to its payment page to enter card data.
5	The cardholder enters their bank card details on the payment page of the online store and sends the data.
6	The merchant sends a payment request to the payment gateway. for payment, such parameters as the order number in the payment gateway (obtained in step 3), language, and card details are used: PAN, CVC, year and month of the card expiration date and the name of the cardholder.
7	Having received payment details (card number, etc.), the system checks whether the card is involved in 3-D Secure, including using the Directory Server.
8	The result of the check is sent to the Store: whether the card is enrolled, the URL of the ACS server of the Issuer where the Customer needs to be authenticated.
9	The store system sends a redirect to the issuer's ACS to the client's browser.
10	The merchant redirects the user to the payment gateway page using the following link: <api.payment gateway address>/acsRedirect.do?orderId=<order number> Please remember to include api. before the domain name.
11	The cardholder (client) is authenticated with the issuer's ACS.
12	After authenticating the cardholder, the issuer's ACS redirects the client to the payment gateway while passing PARes. The payment gateway authorizes the order if the client is successfully authenticated on ACS, or rejects the pre-authorization if the client is not successfully authenticated on the ACS.
13	The client goes to the store page with the payment results.
14	The merchant sends a request for the payment status of the order to the payment gateway.
15	The payment gateway returns the result of order authorization to the store.
16	The store displays the page with the results of the order payment to the client.

Integration using the Finish3DS method

Description:

1	The cardholder places an order on the merchant website (online store) and decides to pay for the goods with a bank card.
2	After the customer confirms the order, the store system registers the order in the payment gateway. Used for registration are such parameters as the amount to be debited, the currency of the debiting, the order number in the Store system, and the URL where the Customer is to be returned.
3	In case of a request for registration, the payment gateway returns a unique order identifier in the payment system and the URL to which it's needed to redirect the user to get the payment form.
4	The online store takes the cardholder's browser to its payment page to enter card data.
5	The cardholder enters their bank card details on the payment page of the online store and sends the data.
6	The merchant sends a payment request to the payment gateway. for payment, such parameters as the order number in the payment gateway (obtained in step 3), language, and card details are used: PAN, CVC, year and month of the card expiration date and the name of the cardholder.
7	Having received payment details (card number, etc.), the system checks whether the card is involved in 3-D Secure, including using the Directory Server.
8	The result of the check is sent to the Store: whether the card is enrolled, the URL of the ACS server of the Issuer where the Customer needs to be authenticated.
9	The store system sends a redirect to the issuer's ACS to the client's browser.
10	The cardholder (client) is authenticated with the issuer's ACS.
11	After authenticating the cardholder, the issuer's ACS redirects the customer back to the store.
12	The PARes received from ACS is sent to the store.
13	The store sends the received PARes to the gateway using the Finish3DS method.
14	The gateway returns the total of the payment.
15	The merchant sends a request for the payment status of the order to the payment gateway.
16	The payment gateway returns the result of order authorization to the store.
17	The store displays the page with the results of the order payment to the client.