# Make Payments with Checkout API
source: https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/3rdparty_authentication_scof/step4/index.md

## Step 4. Make Payments with Checkout API {#step-4-make-payments-with-checkout-api}

It is a pre-requisite to conduct cardholder authentication using Mastercard approved MFA and ID\&V methods, followed by token binding to perform Checkout in the Token Authentication Framework.

An [Authenticating Entity](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/token-authentication/third-party-authentication/authenticating-entity/index.md) completes the cardholder authentication with MFA method, generates `assuranceData` based on MFA results and signs the assertionJWT.

An Integrator must include an authentication assertion and digital transaction data in the [Checkout](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#checkout) API request to Mastercard Checkout Solutions.

An Integrator receives relevant checkout response data depending on the performance of Multi-factor Authentication (MFA), and application of Fraud Liability Protection (FLP).
Diagram taf-making-payments

1. The [Authenticating Entity (AE)](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/token-authentication/third-party-authentication/authenticating-entity/index.md) performs the transaction authentication using a Mastercard-approved MFA method.

2. Once authentication using MFA method has been performed for the PAN, the AE provides the Integrator the MFA method object, containing the MFA results and base64 encoded `assertionJWT`. The Integrator then provides the MFA method object in `additionalData` within `assuranceData`.

   Tip: Learn more about `assertionJWT` in this [section](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/token-authentication/third-party-authentication/authenticating-entity/index.md#generating-assertionjwt).
3. An Integrator makes the [Checkout](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#checkout) request, with the following required parameters in `assuranceData` to Mastercard Checkout Solutions.

   |       Parameter       |                                               Value                                               |
   |-----------------------|---------------------------------------------------------------------------------------------------|
   | verificationType      | CARDHOLDER                                                                                        |
   | verificationEntity    | 01 (SRCI)                                                                                         |
   | verificationEvents    | 01 (Payment transaction)                                                                          |
   | verificationMethod    | 06 (Proprietary method of authentication)                                                         |
   | verificationResults   | 01 (verified)                                                                                     |
   | verificationTimestamp | (System time)                                                                                     |
   | additionalData        | Additional assurance data, such as MFA method object containing a JWT with additional data claims |

4. Depending on the parameters in the Checkout request, an Integrator receives relevant responses, as explained in the table below:

   |                       Checkout Request                        |                          FLP Eligibility                           |           MFA Verification            |                                                              Checkout Response                                                               |
   |---------------------------------------------------------------|--------------------------------------------------------------------|---------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------|
   | `transactionAmount` supplied in the checkout request is not 0 | FLP is eligible for MFA detail provided in request                 | MFA is eligible and has been verified | `checkoutResponseJWS` contains the UCAFv3 cryptogram, `assuranceData`, with `verificationResults` = 01 (verified), and an `eci` value of 02  |
   | `transactionAmount` supplied in the checkout request is not 0 | FLP is not eligible for MFA detail provided in request             | MFA is eligible and has been verified | `checkoutResponseJWS` contains a UCAFv3 cryptogram, `assuranceData` with `verificationResults` = 01 (verified), and an `eci` value of 06     |
   | `transactionAmount` supplied in the checkout request is not 0 | FLP is eligible for MFA detail provided in request                 | MFA is not eligible                   | `checkoutResponseJWS` contains a UCAFv3 cryptogram, `assuranceData` with `verificationResults` = 02 (Not verified), and an `eci` value of 06 |
   | `transactionAmount` supplied in the checkout request is 0     | FLP is eligible or not eligible for MFA detail provided in request | MFA has been verified                 | `checkoutResponseJWS` contains a UCAFv0 cryptogram, `assuranceData` with `verificationResults` = 01 (verified), and an `eci` value of 06     |

Warning: If MFA is not applied, Integrators may apply 3DS authentication on their own rails for PSD2 countries.