Checkout/createCnpThreeDsSession

Create 3DS Session

Create durable browser authentication state when risk requires 3DS.

POST/api/v1/cnp/public/checkout-sessions/{id}/three-ds-session

Browser-safeCall from the customer’s browser with a publishable key — never your secret key.

kepa.js calls this automatically during confirmCheckoutSession unless threeDS is disabled. A successful authentication result must be recorded before confirmation can proceed when risk requires 3DS.

Path parameters

idstringRequired

Checkout session ID.

Request body

application/json

clientSecretstringRequired

Checkout session client secret.

browserIpHashstring

SHA-256 hash of browser IP where available.

userAgentHashstring

SHA-256 hash of user-agent.

billingCountrystring

Billing country placeholder.

Example "US"

mitCitIndicatorenum

Customer-initiated or merchant-initiated transaction.

CITMIT

Response

application/json

idstring

3DS session ID.

statusenum

3DS session status.

CHALLENGE_PENDINGFRICTIONLESSAUTHENTICATEDFAILED

dsTransactionIdstring

Directory server transaction ID placeholder/provider value.

creqstring

Challenge request placeholder/provider value.

Good to know

Current implementation has durable orchestration and a mock challenge shell; production needs a real 3DS server/provider adapter.
The companion result endpoint is /api/v1/cnp/public/checkout-sessions/{id}/three-ds-result.

createCnpThreeDsSession

curl https://api.kepapay.co/api/v1/cnp/public/checkout-sessions/{id}/three-ds-session \ -H "X-Kepa-Publishable-Key: $KEPA_PUBLISHABLE_KEY" \ -H "Content-Type: application/json" \ -d '{ "clientSecret": "cs_7c1b9b86_secret_example", "browserIpHash": "string", "userAgentHash": "string", "billingCountry": "US", "savedPaymentMethod": true, "mitCitIndicator": "CIT" }'