# Verify Authentication
source: https://developer.mastercard.com/consent-management/documentation/tutorials-and-guides/card-consents-tutorial/verify-auth/index.md

## Overview {#overview}

When 3DS authentication requires a challenge, the final step is to verify the authentication result by calling the Consent Management \& Enrollment API `POST /consents/{cardReference}/verify-authentication`.

## Verify Authentication Request {#verify-authentication-request}

Once the 3DS challenge completes, the challenge iframe posts a `threeds-challenge-notification` message to the parent window. The reference app then calls its `/verify-authentication` endpoint, which sends the verification request to the Consent Management \& Enrollment API.
* Java
* Python

```java
// ConsentsController.java

  @RequestMapping(value = "/verify-authentication", method = {RequestMethod.GET, RequestMethod.POST})
  public String verifyAuthentication(RedirectAttributes redirectAttrs, Model model) {

    Map<String, Object> params = new HashMap<>();

    VerifyAuthReq verifyAuthReq = new VerifyAuthReq();
    Auth auth = new Auth();
    auth.setParams(params);
    verifyAuthReq.setAuth(auth);

    try {
      VerifyAuthResp resp = apiService.getApiClient().verifyConsentsAuth(cardRef, verifyAuthReq);

      redirectAttrs.addFlashAttribute("authStatus", resp.getAuth().getStatus());
      redirectAttrs.addFlashAttribute("cardRef", cardRef);

      return "redirect:/consents";

    } catch (ApiException e) {
      model.addAttribute(ERROR_MSG, e.getResponseBody());
    } catch (Exception e) {
      model.addAttribute(ERROR_MSG, e.getMessage());
    }

    return ERROR_TEMPLATE;
  }
```

```python
@app.route("/verify-authentication", methods=['POST', 'GET'])
def verify_authentication():

    verify_data = {}

    resp = api_verify_authentication(session['card_ref'], verify_data)
    session['auth_status'] = resp["auth"]["status"]
    return redirect(url_for('consents_info'))
```

## Authentication Result {#authentication-result}

After successful verification, the reference app redirects to the consents info page. The consent status is updated based on the authentication result:

|          Result          | Consent Status |                            Description                             |
|--------------------------|----------------|--------------------------------------------------------------------|
| Authentication succeeded | `APPROVED`     | The consent is active and the card is enrolled for notifications.  |
| Authentication failed    | `FAILED`       | The consent was not approved. The cardholder can retry enrollment. |

The consents info page displays the `cardReference` and the authentication status. You can use the `cardReference` to retrieve or revoke consents, as described in the next step.

The next step is [Get and Delete Consents](https://developer.mastercard.com/consent-management/documentation/tutorials-and-guides/card-consents-tutorial/get-and-delete-consents/index.md).