# Passkeys source: https://developer.mastercard.com/issuer-enrollment/documentation/testing/passkeys/index.md Use these test scenarios to verify that you can create and bind a new Mastercard payment passkey or bind an existing passkey to the cardholder's device. ### Prerequisites {#prerequisites} * Complete Click to Pay [onboarding](https://developer.mastercard.com/issuer-enrollment/documentation/tutorials-and-guides/issuer-onboarding-click2pay-tutorial/index.md) with Mastercard Checkout Solutions. * Familiarize yourself with [Getting Started With Passkeys](https://developer.mastercard.com/issuer-enrollment/documentation/use-cases/passkeys/index.md) use case. * Enable your account ranges for passkey authentication. * Configure the test card's country and issuer as eligible for FIDO multi-factor authentication. * Verify the `accountReference` (PAN, email address, phone number) information supplied by the cardholder. * Capture the cardholder's consent (on behalf of Mastercard) to enroll for a Mastercard payment passkey. ### Test scenarios {#test-scenarios} Use the following scenarios to test the setup and binding of new and existing Mastercard payment passkey to a device. | Test area | Scenario | |------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | New passkey setup | * [Successful passkey creation](https://developer.mastercard.com/issuer-enrollment/documentation/testing/passkeys/index.md#successful-passkey-creation-and-binding) * [Failed passkey creation](https://developer.mastercard.com/issuer-enrollment/documentation/testing/passkeys/index.md#failed-passkey-creation-and-binding) | | Existing passkey setup | [Bind an existing passkey to a device](https://developer.mastercard.com/issuer-enrollment/documentation/testing/passkeys/index.md#bind-an-existing-passkey-to-a-device) | ## Set up a New Mastercard Payment Passkey {#set-up-a-new-mastercard-payment-passkey} ### Successful passkey creation and binding {#successful-passkey-creation-and-binding} Create a Mastercard payment passkey and bind it to the cardholder's device. **Send the request** > `POST /sessions` > > Submit a request with the cardholder details, such as email address, phone number, and card details, along with the `callbackUri` to initiate Mastercard payment passkey registration. ```json { "srcClientId": "43c3630f-882c-4341-8868-0f73a5fd14d5", "srcCorrelationId": "d7ff0bc2-6486-4be5-a0b9-2938bb7b378e", "srciTransactionId": "86bd4a91-46ba-4b2c-9b4a-59eea3812f01", "assuranceData": { "verificationData": [ { "verificationType": "CARDHOLDER", "verificationEntity": "03", "verificationMethod": "06", "verificationResults": "01", "verificationTimestamp": "1678294563", "verificationEvents": [ "04" ], "additionalData": { "accountReference": { "card": { "primaryAccountNumber": "5299920971401623001", "panExpirationMonth": "08", "panExpirationYear": "2031" } } } }] }, "authenticationMethod": { "authenticationMethodType": "FIDO2", "authenticationSubject": "CONSUMER", "authenticator": { "certifiedSolutionId": "20001", "metadata": { "fido2": { "displayName": "k*****c@mastercard.com" } } } }, "authenticationContext": { "uriData": { "uri": "https://stage.demos.verify.mastercard.com/das-sdk-test/", "uriType": "WEB_URI" } }, "locale": "en-AU" } ``` **Expected response** > Mastercard responds with a registration `uri` used to invoke Mastercard payment passkey registration. ```json { "srcCorrelationId": "d7ff0bc2-6486-4be5-a0b9-2938bb7b378e", "srciTransactionId": "86bd4a91-46ba-4b2c-9b4a-59eea3812f01", "authenticationSessionId": "fcjUcwg1QfiHKDbZF3vSdg000000000010US", "authenticationMethod": { "authenticationMethodType": "FIDO2", "authenticationSubject": "CONSUMER", "uriData": { "uri": "https://stage.verify.mastercard.com/auth/passkeys?authSessionId=fcjUcwg1QfiHKDbZF3vSdg000000000010US&clientId=43c3630f-882c-4341-8868-0f73a5fd14d5&clientSessionId=86bd4a91-46ba-4b2c-9b4a-59eea3812f01&locale=en-AU&accessToken=eyJraWQiOiIyMDI0MDkwMjExMTAzOC1zdGctbWMtZGFzLWZlZHJhdGVkLXRva2VuLXNyYy1tYXN0ZXJjYXJkLWludCIsInR5cCI6IkpXVCIsImFsZyI6IlJTMjU2In0.eyJhdWQiOiJkaWdpdGFsYXV0aGVudGljYXRpb25zZXJ2aWNlIiwic3ViIjoiNjNkNGNiZWYtOGYwZC00NzRkLTk0ZTItN2IyY2ExZjg2ZjhmIiwibmJmIjoxNzU3NDg2NzY1LCJpc3MiOiJodHRwczpcL1wvc3RhZ2UudmVyaWZ5Lm1hc3RlcmNhcmQuY29tIiwiZXhwIjoxNzU3NDg3NjY1LCJpYXQiOjE3NTc0ODY3NjUsImNpZCI6IjYzZDRjYmVmLThmMGQtNDc0ZC05NGUyLTdiMmNhMWY4NmY4ZiJ9.BMZltny8mz8cLav05zkmZfaBz8ijTv0SrIkYPfDn_ki0ToOElmmc8fdB5MYHicx8KdDosYYTuWDUev5KywMEgUUn-EQDRCH6aYoy_Paa5A1SrChWaC8wxsPyNtLSPiuff0z7ScHiEYMZ6U7Py1h0njUswQ01haiIMwcN-p9731rvmbg7FYD3zDf1a8DKbMW2bDvGNb0sPDL95trptl3uu2QD8ajQLy12HY_IKUxBvB0RELcgJ56cJhCdWmxM8JyaSWPKq1jzppKe7DcC7bATic-TgIYiHu6R2HrbaRwl7QOtr6kzS2EOxPWiCa-lAQ9ADVcB8ug3eE_Rqk3BBy-fuQ", "uriType": "WEB_URL" } } } ``` **Perform cardholder verification** > Launch the Mastercard URL in a browser, where Mastercard prompts the cardholder to perform verification. > > Once the cardholder successfully creates the Mastercard payment passkey, Mastercard provides proof of authentication (POA), and redirects the cardholder to the `callbackUri` provided in the initial request. **Bind passkey to device** > `POST /authenticators` > > Submit a request to bind the newly created payment passkey to a device and the `accountReference` (PAN, email address, phone number) information. ```json { "srcClientId": "43c3630f-882c-4341-8868-0f73a5fd14d5", "srcCorrelationId": "d7ff0bc2-6486-4be5-a0b9-2938bb7b378e", "srciTransactionId": "86bd4a91-46ba-4b2c-9b4a-59eea3812f01", "authenticationSessionId": "mJfiO_sKSJ-_DfsdHjkJqw000000000010US", "assuranceData": { "verificationData": [ { "verificationType": "CONSUMER", "verificationEntity": "02", "verificationMethod": "12", "verificationResults": "04", "verificationEvents": [ "64" ], "verificationTimestamp": "1678294563", "additionalData": { "proofOfAuthentication": "eyJraWQiOiIyMDI1MDMyNDE3MTgwNy1kYXMtbWFjLXNpZ24tc3RnIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJpc0NoYWxsZW5nZVBlcmZvcm1lZCI6dHJ1ZSwiY29tcGxldGVkQXQiOjE3NTY5Njk1NTcsImFzc2VydGlvblR5cGUiOiJvd25lcnNoaXAiLCJjZXJ0aWZpZWRNRkFNZXRob2RJZCI6IjIwMDAxIiwiaXNzIjoiaHR0cHM6XC9cL3N0YWdlLnZlcmlmeS5tYXN0ZXJjYXJkLmNvbSIsImF1dGhlbnRpY2F0aW9uRmFjdG9ycyI6IjAyMEEiLCJhcHBJbnN0YW5jZUlkIjoiTEtzWlZSWW5ReGFaeVVSQjNHVFVNQTAwMDAwMDAwMDAxMFVTIiwiYXVkIjoiaHR0cHM6XC9cL21hc3RlcmNhcmQuY29tIiwiY2xpZW50U2Vzc2lvbklkIjoiODZiZDRhOTEtNDZiYS00YjJjLTliNGEtNTllZWEzODEyZjAxIiwiYXV0aGVudGljYXRpb25NZXRob2QiOiJGSURPMiIsImRhc0F1dGhlbnRpY2F0b3JJbnN0YW5jZUlkIjoiMk1qZ2xLZ0hSMFM1b2lVaFpqZm9PQTAwMDAwMDAwMDAxMFVTIiwiZXhwIjoxNzU2OTcwNDU3LCJpYXQiOjE3NTY5Njk1NTcsImF1dGhlbnRpY2F0aW9uUmVhc29ucyI6WyJCSU5EX0FVVEhFTlRJQ0FUT1IiXX0.quUB8YtICXtmUOsQb8b_gJwyjvvYjzMpgPeY_VzGsn14deonZBnuj4ACUaRss7O6zNyGmArfm4O6g_p7Wr36vbM0SJ1wDUT-s7d4EJcHwaLDHxZw24wfCtqtt_TGwr-DImHLj1q-Ib70tbMQbO7AqPWSsL5Xgd8kZotF8oBTcxQ8W_G8vlT7xxesqqbmG0J-F2Pak3DY5wa6tn3fiAMndc9b6PchJSCrCZNyYGI8gJsenOlPSXKOC-hbS__tOiWIxsp9GaxQoyfzEWNAcMz8r47nThKHqXVdQlwrItzQKIxGvbncHvjm8SVIZHWPe5aiziWDV8moGaaw8xRqCETh9Q" } } ] } } ``` **Expected response** > On successful bind, Mastercard responds back with `credentialId` and `bindingId`. > > Notify the cardholder that their Mastercard payment passkey was successfully created. ```json { "srcCorrelationId": "d7ff0bc2-6486-4be5-a0b9-2938bb7b378e", "srciTransactionId": "86bd4a91-46ba-4b2c-9b4a-59eea3812f01", "authenticationSessionId": "mJfiO_sKSJ-_DfsdHjkJqw000000000010US", "credentialId": "2MjglKgHR0S5oiUhZjfoOA000000000010US", "bindingId": "LKsZVRYnQxaZyURB3GTUMA000000000010US" } ``` ### Failed passkey creation {#failed-passkey-creation} Verify the expected outcome when the Mastercard payment passkey cannot be created due to an authentication failure. **Send the request** > `POST /sessions` > > Submit a request with the cardholder details, such as email address, phone number, card details, along with the `callbackUri` to initiate Mastercard payment passkey registration. ```json { "srcClientId": "43c3630f-882c-4341-8868-0f73a5fd14d5", "srcCorrelationId": "d7ff0bc2-6486-4be5-a0b9-2938bb7b378e", "srciTransactionId": "86bd4a91-46ba-4b2c-9b4a-59eea3812f01", "assuranceData": { "verificationData": [ { "verificationType": "CARDHOLDER", "verificationEntity": "03", "verificationMethod": "06", "verificationResults": "01", "verificationTimestamp": "1678294563", "verificationEvents": [ "04" ], "additionalData": { "accountReference": { "card": { "primaryAccountNumber": "5299920971401623001", "panExpirationMonth": "08", "panExpirationYear": "2031" } } } }] }, "authenticationMethod": { "authenticationMethodType": "FIDO2", "authenticationSubject": "CONSUMER", "authenticator": { "certifiedSolutionId": "20001", "metadata": { "fido2": { "displayName": "k*****c@mastercard.com" } } } }, "authenticationContext": { "uriData": { "uri": "https://stage.demos.verify.mastercard.com/das-sdk-test/", "uriType": "WEB_URI" } }, "locale": "en-AU" } ``` **Expected response** > Mastercard responds with a registration `uri` used to invoke Mastercard payment passkey registration. ```json { "srcCorrelationId": "d7ff0bc2-6486-4be5-a0b9-2938bb7b378e", "srciTransactionId": "86bd4a91-46ba-4b2c-9b4a-59eea3812f01", "authenticationSessionId": "fcjUcwg1QfiHKDbZF3vSdg000000000010US", "authenticationMethod": { "authenticationMethodType": "FIDO2", "authenticationSubject": "CONSUMER", "uriData": { "uri": "https://stage.verify.mastercard.com/auth/passkeys?authSessionId=fcjUcwg1QfiHKDbZF3vSdg000000000010US&clientId=43c3630f-882c-4341-8868-0f73a5fd14d5&clientSessionId=86bd4a91-46ba-4b2c-9b4a-59eea3812f01&locale=en-AU&accessToken=eyJraWQiOiIyMDI0MDkwMjExMTAzOC1zdGctbWMtZGFzLWZlZHJhdGVkLXRva2VuLXNyYy1tYXN0ZXJjYXJkLWludCIsInR5cCI6IkpXVCIsImFsZyI6IlJTMjU2In0.eyJhdWQiOiJkaWdpdGFsYXV0aGVudGljYXRpb25zZXJ2aWNlIiwic3ViIjoiNjNkNGNiZWYtOGYwZC00NzRkLTk0ZTItN2IyY2ExZjg2ZjhmIiwibmJmIjoxNzU3NDg2NzY1LCJpc3MiOiJodHRwczpcL1wvc3RhZ2UudmVyaWZ5Lm1hc3RlcmNhcmQuY29tIiwiZXhwIjoxNzU3NDg3NjY1LCJpYXQiOjE3NTc0ODY3NjUsImNpZCI6IjYzZDRjYmVmLThmMGQtNDc0ZC05NGUyLTdiMmNhMWY4NmY4ZiJ9.BMZltny8mz8cLav05zkmZfaBz8ijTv0SrIkYPfDn_ki0ToOElmmc8fdB5MYHicx8KdDosYYTuWDUev5KywMEgUUn-EQDRCH6aYoy_Paa5A1SrChWaC8wxsPyNtLSPiuff0z7ScHiEYMZ6U7Py1h0njUswQ01haiIMwcN-p9731rvmbg7FYD3zDf1a8DKbMW2bDvGNb0sPDL95trptl3uu2QD8ajQLy12HY_IKUxBvB0RELcgJ56cJhCdWmxM8JyaSWPKq1jzppKe7DcC7bATic-TgIYiHu6R2HrbaRwl7QOtr6kzS2EOxPWiCa-lAQ9ADVcB8ug3eE_Rqk3BBy-fuQ", "uriType": "WEB_URL" } } } ``` **Perform cardholder verification** > Launch the Mastercard URL in a browser, where Mastercard prompts the cardholder to perform verification. In this instance, the cardholder fails to provide correct biometrics and does not authenticate the device. > > Mastercard redirects to the `callbackUri` provided in the initial request with the following error code and error message. ```javascript https://callback_uri?status=ERROR&reason=CREDENTIALS_CREATION_NOT_ALLOWED ``` **Notify the cardholder** > Display an error message on your app or website to notify the cardholder that Mastercard payment passkey creation failed. ## Set up an Existing Mastercard Payment Passkey {#set-up-an-existing-mastercard-payment-passkey} ### Bind an existing passkey to a device {#bind-an-existing-passkey-to-a-device} Bind an existing Mastercard payment passkey to the cardholder's device. **Send the request** > `POST /sessions` > > Submit a request with cardholder details, such as email address, phone number, card details, along with the `callbackUri` to initiate Mastercard payment passkey registration. ```json { "srcClientId": "43c3630f-882c-4341-8868-0f73a5fd14d5", "srcCorrelationId": "d7ff0bc2-6486-4be5-a0b9-2938bb7b378e", "srciTransactionId": "86bd4a91-46ba-4b2c-9b4a-59eea3812f01", "assuranceData": { "verificationData": [ { "verificationType": "CARDHOLDER", "verificationEntity": "03", "verificationMethod": "06", "verificationResults": "01", "verificationTimestamp": "1678294563", "verificationEvents": [ "04" ], "additionalData": { "accountReference": { "card": { "primaryAccountNumber": "5299920971401623001", "panExpirationMonth": "08", "panExpirationYear": "2031" } } } }] }, "authenticationMethod": { "authenticationMethodType": "FIDO2", "authenticationSubject": "CONSUMER", "authenticator": { "certifiedSolutionId": "20001", "metadata": { "fido2": { "displayName": "k*****c@mastercard.com" } } } }, "authenticationContext": { "uriData": { "uri": "https://stage.demos.verify.mastercard.com/das-sdk-test/", "uriType": "WEB_URI" } }, "locale": "en-AU" } ``` **Expected response** > Mastercard responds with a registration `uri` used to invoke Mastercard payment passkey registration and validation. ```json { "srcCorrelationId": "d7ff0bc2-6486-4be5-a0b9-2938bb7b378e", "srciTransactionId": "86bd4a91-46ba-4b2c-9b4a-59eea3812f01", "authenticationSessionId": "fcjUcwg1QfiHKDbZF3vSdg000000000010US", "authenticationMethod": { "authenticationMethodType": "FIDO2", "authenticationSubject": "CONSUMER", "uriData": { "uri": "https://stage.verify.mastercard.com/auth/passkeys?authSessionId=fcjUcwg1QfiHKDbZF3vSdg000000000010US&clientId=43c3630f-882c-4341-8868-0f73a5fd14d5&clientSessionId=86bd4a91-46ba-4b2c-9b4a-59eea3812f01&locale=en-AU&accessToken=eyJraWQiOiIyMDI0MDkwMjExMTAzOC1zdGctbWMtZGFzLWZlZHJhdGVkLXRva2VuLXNyYy1tYXN0ZXJjYXJkLWludCIsInR5cCI6IkpXVCIsImFsZyI6IlJTMjU2In0.eyJhdWQiOiJkaWdpdGFsYXV0aGVudGljYXRpb25zZXJ2aWNlIiwic3ViIjoiNjNkNGNiZWYtOGYwZC00NzRkLTk0ZTItN2IyY2ExZjg2ZjhmIiwibmJmIjoxNzU3NDg2NzY1LCJpc3MiOiJodHRwczpcL1wvc3RhZ2UudmVyaWZ5Lm1hc3RlcmNhcmQuY29tIiwiZXhwIjoxNzU3NDg3NjY1LCJpYXQiOjE3NTc0ODY3NjUsImNpZCI6IjYzZDRjYmVmLThmMGQtNDc0ZC05NGUyLTdiMmNhMWY4NmY4ZiJ9.BMZltny8mz8cLav05zkmZfaBz8ijTv0SrIkYPfDn_ki0ToOElmmc8fdB5MYHicx8KdDosYYTuWDUev5KywMEgUUn-EQDRCH6aYoy_Paa5A1SrChWaC8wxsPyNtLSPiuff0z7ScHiEYMZ6U7Py1h0njUswQ01haiIMwcN-p9731rvmbg7FYD3zDf1a8DKbMW2bDvGNb0sPDL95trptl3uu2QD8ajQLy12HY_IKUxBvB0RELcgJ56cJhCdWmxM8JyaSWPKq1jzppKe7DcC7bATic-TgIYiHu6R2HrbaRwl7QOtr6kzS2EOxPWiCa-lAQ9ADVcB8ug3eE_Rqk3BBy-fuQ", "uriType": "WEB_URL" } } } ``` **Perform cardholder verification** > Launch the Mastercard URL in a browser, where Mastercard prompts the cardholder to perform verification. > > The cardholder successfully authenticates with an existing Mastercard payment passkey. > > Mastercard provides the proof of authentication (POA), and redirects the cardholder to the `callbackUri` provided in the initial request. **Bind passkey to device** > `POST /authenticators` > > Submit a request to bind the existing payment passkey to a device and the `accountReference` (PAN, email address, phone number) information. ```json { "srcClientId": "43c3630f-882c-4341-8868-0f73a5fd14d5", "srcCorrelationId": "d7ff0bc2-6486-4be5-a0b9-2938bb7b378e", "srciTransactionId": "86bd4a91-46ba-4b2c-9b4a-59eea3812f01", "authenticationSessionId": "mJfiO_sKSJ-_DfsdHjkJqw000000000010US", "assuranceData": { "verificationData": [ { "verificationType": "CONSUMER", "verificationEntity": "02", "verificationMethod": "12", "verificationResults": "04", "verificationEvents": [ "64" ], "verificationTimestamp": "1678294563", "additionalData": { "proofOfAuthentication": "eyJraWQiOiIyMDI1MDMyNDE3MTgwNy1kYXMtbWFjLXNpZ24tc3RnIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJpc0NoYWxsZW5nZVBlcmZvcm1lZCI6dHJ1ZSwiY29tcGxldGVkQXQiOjE3NTY5Njk1NTcsImFzc2VydGlvblR5cGUiOiJvd25lcnNoaXAiLCJjZXJ0aWZpZWRNRkFNZXRob2RJZCI6IjIwMDAxIiwiaXNzIjoiaHR0cHM6XC9cL3N0YWdlLnZlcmlmeS5tYXN0ZXJjYXJkLmNvbSIsImF1dGhlbnRpY2F0aW9uRmFjdG9ycyI6IjAyMEEiLCJhcHBJbnN0YW5jZUlkIjoiTEtzWlZSWW5ReGFaeVVSQjNHVFVNQTAwMDAwMDAwMDAxMFVTIiwiYXVkIjoiaHR0cHM6XC9cL21hc3RlcmNhcmQuY29tIiwiY2xpZW50U2Vzc2lvbklkIjoiODZiZDRhOTEtNDZiYS00YjJjLTliNGEtNTllZWEzODEyZjAxIiwiYXV0aGVudGljYXRpb25NZXRob2QiOiJGSURPMiIsImRhc0F1dGhlbnRpY2F0b3JJbnN0YW5jZUlkIjoiMk1qZ2xLZ0hSMFM1b2lVaFpqZm9PQTAwMDAwMDAwMDAxMFVTIiwiZXhwIjoxNzU2OTcwNDU3LCJpYXQiOjE3NTY5Njk1NTcsImF1dGhlbnRpY2F0aW9uUmVhc29ucyI6WyJCSU5EX0FVVEhFTlRJQ0FUT1IiXX0.quUB8YtICXtmUOsQb8b_gJwyjvvYjzMpgPeY_VzGsn14deonZBnuj4ACUaRss7O6zNyGmArfm4O6g_p7Wr36vbM0SJ1wDUT-s7d4EJcHwaLDHxZw24wfCtqtt_TGwr-DImHLj1q-Ib70tbMQbO7AqPWSsL5Xgd8kZotF8oBTcxQ8W_G8vlT7xxesqqbmG0J-F2Pak3DY5wa6tn3fiAMndc9b6PchJSCrCZNyYGI8gJsenOlPSXKOC-hbS__tOiWIxsp9GaxQoyfzEWNAcMz8r47nThKHqXVdQlwrItzQKIxGvbncHvjm8SVIZHWPe5aiziWDV8moGaaw8xRqCETh9Q" } } ] } } ``` **Expected response** > On successful bind, Mastercard responds back with `credentialId` and `bindingId`. > > Notify the cardholder that the Mastercard payment passkey was successfully validated. ```json { "srcCorrelationId": "d7ff0bc2-6486-4be5-a0b9-2938bb7b378e", "srciTransactionId": "86bd4a91-46ba-4b2c-9b4a-59eea3812f01", "authenticationSessionId": "mJfiO_sKSJ-_DfsdHjkJqw000000000010US", "credentialId": "2MjglKgHR0S5oiUhZjfoOA000000000010US", "bindingId": "LKsZVRYnQxaZyURB3GTUMA000000000010US" } ``` ## Next Steps {#next-steps} * Consult the [API Reference](https://developer.mastercard.com/issuer-enrollment/documentation/api-reference/apis/index.md#authentication-apis) for complete endpoint specifications, request and response schemas, and environment URLs. * If you run into issues, visit [Support](https://developer.mastercard.com/issuer-enrollment/documentation/support/index.md) for FAQs and troubleshooting guidance.