Initiate 3DS authentication
curl --request POST \
--url https://api-global.fastpaybrasil.com/v1/three-ds/authenticate \
--header 'Authorization: Basic <encoded-value>' \
--header 'Content-Type: application/json' \
--data '
{
"amount": 100,
"currency": "BRL",
"card": {
"number": "4111111111111111",
"expirationMonth": "12",
"expirationYear": "2025",
"holderName": "John Doe"
},
"browser": {
"userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
"ipAddress": "177.128.144.97",
"acceptHeader": "text/html,application/xhtml+xml",
"language": "pt-BR",
"timezoneOffset": -180,
"javascriptEnabled": true,
"javaEnabled": false,
"screenWidth": 1920,
"screenHeight": 1080,
"colorDepth": 24
}
}
'import requests
url = "https://api-global.fastpaybrasil.com/v1/three-ds/authenticate"
payload = {
"amount": 100,
"currency": "BRL",
"card": {
"number": "4111111111111111",
"expirationMonth": "12",
"expirationYear": "2025",
"holderName": "John Doe"
},
"browser": {
"userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
"ipAddress": "177.128.144.97",
"acceptHeader": "text/html,application/xhtml+xml",
"language": "pt-BR",
"timezoneOffset": -180,
"javascriptEnabled": True,
"javaEnabled": False,
"screenWidth": 1920,
"screenHeight": 1080,
"colorDepth": 24
}
}
headers = {
"Authorization": "Basic <encoded-value>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Basic <encoded-value>', 'Content-Type': 'application/json'},
body: JSON.stringify({
amount: 100,
currency: 'BRL',
card: {
number: '4111111111111111',
expirationMonth: '12',
expirationYear: '2025',
holderName: 'John Doe'
},
browser: {
userAgent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
ipAddress: '177.128.144.97',
acceptHeader: 'text/html,application/xhtml+xml',
language: 'pt-BR',
timezoneOffset: -180,
javascriptEnabled: true,
javaEnabled: false,
screenWidth: 1920,
screenHeight: 1080,
colorDepth: 24
}
})
};
fetch('https://api-global.fastpaybrasil.com/v1/three-ds/authenticate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-global.fastpaybrasil.com/v1/three-ds/authenticate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'amount' => 100,
'currency' => 'BRL',
'card' => [
'number' => '4111111111111111',
'expirationMonth' => '12',
'expirationYear' => '2025',
'holderName' => 'John Doe'
],
'browser' => [
'userAgent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
'ipAddress' => '177.128.144.97',
'acceptHeader' => 'text/html,application/xhtml+xml',
'language' => 'pt-BR',
'timezoneOffset' => -180,
'javascriptEnabled' => true,
'javaEnabled' => false,
'screenWidth' => 1920,
'screenHeight' => 1080,
'colorDepth' => 24
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Basic <encoded-value>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api-global.fastpaybrasil.com/v1/three-ds/authenticate"
payload := strings.NewReader("{\n \"amount\": 100,\n \"currency\": \"BRL\",\n \"card\": {\n \"number\": \"4111111111111111\",\n \"expirationMonth\": \"12\",\n \"expirationYear\": \"2025\",\n \"holderName\": \"John Doe\"\n },\n \"browser\": {\n \"userAgent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\",\n \"ipAddress\": \"177.128.144.97\",\n \"acceptHeader\": \"text/html,application/xhtml+xml\",\n \"language\": \"pt-BR\",\n \"timezoneOffset\": -180,\n \"javascriptEnabled\": true,\n \"javaEnabled\": false,\n \"screenWidth\": 1920,\n \"screenHeight\": 1080,\n \"colorDepth\": 24\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Basic <encoded-value>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api-global.fastpaybrasil.com/v1/three-ds/authenticate")
.header("Authorization", "Basic <encoded-value>")
.header("Content-Type", "application/json")
.body("{\n \"amount\": 100,\n \"currency\": \"BRL\",\n \"card\": {\n \"number\": \"4111111111111111\",\n \"expirationMonth\": \"12\",\n \"expirationYear\": \"2025\",\n \"holderName\": \"John Doe\"\n },\n \"browser\": {\n \"userAgent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\",\n \"ipAddress\": \"177.128.144.97\",\n \"acceptHeader\": \"text/html,application/xhtml+xml\",\n \"language\": \"pt-BR\",\n \"timezoneOffset\": -180,\n \"javascriptEnabled\": true,\n \"javaEnabled\": false,\n \"screenWidth\": 1920,\n \"screenHeight\": 1080,\n \"colorDepth\": 24\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api-global.fastpaybrasil.com/v1/three-ds/authenticate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Basic <encoded-value>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"amount\": 100,\n \"currency\": \"BRL\",\n \"card\": {\n \"number\": \"4111111111111111\",\n \"expirationMonth\": \"12\",\n \"expirationYear\": \"2025\",\n \"holderName\": \"John Doe\"\n },\n \"browser\": {\n \"userAgent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\",\n \"ipAddress\": \"177.128.144.97\",\n \"acceptHeader\": \"text/html,application/xhtml+xml\",\n \"language\": \"pt-BR\",\n \"timezoneOffset\": -180,\n \"javascriptEnabled\": true,\n \"javaEnabled\": false,\n \"screenWidth\": 1920,\n \"screenHeight\": 1080,\n \"colorDepth\": 24\n }\n}"
response = http.request(request)
puts response.read_body{
"authenticationId": "tdsa_1QmCRMJM0r9zBvr4OVmMRa6X",
"status": "requires_submission",
"fingerprintingUrl": "https://hooks.stripe.com/three_d_secure/fingerprint/acct_xxx/tdsa_xxx",
"challengeUrl": "https://hooks.stripe.com/three_d_secure/challenge/acct_xxx/tdsa_xxx",
"outcome": "authenticated"
}{
"statusCode": 422,
"message": "SubMerchant is not active",
"error": "Unprocessable Entity"
}3D Secure
Initiate 3DS authentication
Creates a 3D Secure authentication object. The response may include
fingerprintingUrl (render in a hidden iframe and listen for postMessage)
or challengeUrl (render in a visible iframe for user challenge).
Authentication: Uses the merchant’s public/publishable key
(pk_...) in the Authorization header as Basic auth username.
POST
/
v1
/
three-ds
/
authenticate
Initiate 3DS authentication
curl --request POST \
--url https://api-global.fastpaybrasil.com/v1/three-ds/authenticate \
--header 'Authorization: Basic <encoded-value>' \
--header 'Content-Type: application/json' \
--data '
{
"amount": 100,
"currency": "BRL",
"card": {
"number": "4111111111111111",
"expirationMonth": "12",
"expirationYear": "2025",
"holderName": "John Doe"
},
"browser": {
"userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
"ipAddress": "177.128.144.97",
"acceptHeader": "text/html,application/xhtml+xml",
"language": "pt-BR",
"timezoneOffset": -180,
"javascriptEnabled": true,
"javaEnabled": false,
"screenWidth": 1920,
"screenHeight": 1080,
"colorDepth": 24
}
}
'import requests
url = "https://api-global.fastpaybrasil.com/v1/three-ds/authenticate"
payload = {
"amount": 100,
"currency": "BRL",
"card": {
"number": "4111111111111111",
"expirationMonth": "12",
"expirationYear": "2025",
"holderName": "John Doe"
},
"browser": {
"userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
"ipAddress": "177.128.144.97",
"acceptHeader": "text/html,application/xhtml+xml",
"language": "pt-BR",
"timezoneOffset": -180,
"javascriptEnabled": True,
"javaEnabled": False,
"screenWidth": 1920,
"screenHeight": 1080,
"colorDepth": 24
}
}
headers = {
"Authorization": "Basic <encoded-value>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Basic <encoded-value>', 'Content-Type': 'application/json'},
body: JSON.stringify({
amount: 100,
currency: 'BRL',
card: {
number: '4111111111111111',
expirationMonth: '12',
expirationYear: '2025',
holderName: 'John Doe'
},
browser: {
userAgent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
ipAddress: '177.128.144.97',
acceptHeader: 'text/html,application/xhtml+xml',
language: 'pt-BR',
timezoneOffset: -180,
javascriptEnabled: true,
javaEnabled: false,
screenWidth: 1920,
screenHeight: 1080,
colorDepth: 24
}
})
};
fetch('https://api-global.fastpaybrasil.com/v1/three-ds/authenticate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-global.fastpaybrasil.com/v1/three-ds/authenticate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'amount' => 100,
'currency' => 'BRL',
'card' => [
'number' => '4111111111111111',
'expirationMonth' => '12',
'expirationYear' => '2025',
'holderName' => 'John Doe'
],
'browser' => [
'userAgent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
'ipAddress' => '177.128.144.97',
'acceptHeader' => 'text/html,application/xhtml+xml',
'language' => 'pt-BR',
'timezoneOffset' => -180,
'javascriptEnabled' => true,
'javaEnabled' => false,
'screenWidth' => 1920,
'screenHeight' => 1080,
'colorDepth' => 24
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Basic <encoded-value>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api-global.fastpaybrasil.com/v1/three-ds/authenticate"
payload := strings.NewReader("{\n \"amount\": 100,\n \"currency\": \"BRL\",\n \"card\": {\n \"number\": \"4111111111111111\",\n \"expirationMonth\": \"12\",\n \"expirationYear\": \"2025\",\n \"holderName\": \"John Doe\"\n },\n \"browser\": {\n \"userAgent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\",\n \"ipAddress\": \"177.128.144.97\",\n \"acceptHeader\": \"text/html,application/xhtml+xml\",\n \"language\": \"pt-BR\",\n \"timezoneOffset\": -180,\n \"javascriptEnabled\": true,\n \"javaEnabled\": false,\n \"screenWidth\": 1920,\n \"screenHeight\": 1080,\n \"colorDepth\": 24\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Basic <encoded-value>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api-global.fastpaybrasil.com/v1/three-ds/authenticate")
.header("Authorization", "Basic <encoded-value>")
.header("Content-Type", "application/json")
.body("{\n \"amount\": 100,\n \"currency\": \"BRL\",\n \"card\": {\n \"number\": \"4111111111111111\",\n \"expirationMonth\": \"12\",\n \"expirationYear\": \"2025\",\n \"holderName\": \"John Doe\"\n },\n \"browser\": {\n \"userAgent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\",\n \"ipAddress\": \"177.128.144.97\",\n \"acceptHeader\": \"text/html,application/xhtml+xml\",\n \"language\": \"pt-BR\",\n \"timezoneOffset\": -180,\n \"javascriptEnabled\": true,\n \"javaEnabled\": false,\n \"screenWidth\": 1920,\n \"screenHeight\": 1080,\n \"colorDepth\": 24\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api-global.fastpaybrasil.com/v1/three-ds/authenticate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Basic <encoded-value>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"amount\": 100,\n \"currency\": \"BRL\",\n \"card\": {\n \"number\": \"4111111111111111\",\n \"expirationMonth\": \"12\",\n \"expirationYear\": \"2025\",\n \"holderName\": \"John Doe\"\n },\n \"browser\": {\n \"userAgent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\",\n \"ipAddress\": \"177.128.144.97\",\n \"acceptHeader\": \"text/html,application/xhtml+xml\",\n \"language\": \"pt-BR\",\n \"timezoneOffset\": -180,\n \"javascriptEnabled\": true,\n \"javaEnabled\": false,\n \"screenWidth\": 1920,\n \"screenHeight\": 1080,\n \"colorDepth\": 24\n }\n}"
response = http.request(request)
puts response.read_body{
"authenticationId": "tdsa_1QmCRMJM0r9zBvr4OVmMRa6X",
"status": "requires_submission",
"fingerprintingUrl": "https://hooks.stripe.com/three_d_secure/fingerprint/acct_xxx/tdsa_xxx",
"challengeUrl": "https://hooks.stripe.com/three_d_secure/challenge/acct_xxx/tdsa_xxx",
"outcome": "authenticated"
}{
"statusCode": 422,
"message": "SubMerchant is not active",
"error": "Unprocessable Entity"
}Authorizations
HTTP Basic authentication. Use your secret key as the username and an empty string as password. The API key should be base64 encoded in the format 'username:' when sending the Authorization header.
Body
application/json
Transaction amount in the currency of the transaction
Example:
100
ISO 4217 currency code
Example:
"BRL"
Show child attributes
Show child attributes
Browser data collected from the customer's browser for 3DS authentication.
Show child attributes
Show child attributes
Response
Authentication initiated successfully
3DS Authentication ID — pass this to submit/cancel/challenge-result
Example:
"tdsa_1QmCRMJM0r9zBvr4OVmMRa6X"
Current authentication status
Available options:
requires_submission, requires_challenge, succeeded, failed, error, canceled, processing Example:
"requires_submission"
URL to render in a hidden iframe. Listen for postMessage events
with fingerprintingResult and then call POST /v1/three-ds/submit.
Example:
"https://hooks.stripe.com/three_d_secure/fingerprint/acct_xxx/tdsa_xxx"
URL to render in a visible iframe when status is requires_challenge.
Example:
"https://hooks.stripe.com/three_d_secure/challenge/acct_xxx/tdsa_xxx"
Authentication outcome (only present in terminal states)
Available options:
authenticated, informational, attempt_acknowledged, rejected, denied, abandoned, not_supported, processing_error, internal_error, canceled Example:
"authenticated"
⌘I