# Launch Auth UI and Perform Authentication
source: https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/integrate_apis_scof/step5/index.md

## Step 5: Launch Auth UI and Perform Authentication {#step-5-launch-auth-ui-and-perform-authentication}


Note: Performing cardholder authentication is required for Secure Card on File. However, it may not be applicable for all checkout or transaction scenarios.   
Once a PAN is registered with Secure Card on File, an Integrator can perform ID\&V using one of the following approaches:   

<br />

<br />

Integrators can use **B2B APIs** to retrieve the **Authentication UI URL** for:

* Redirecting users from a **web browser**
* Loading inside a **web-hosted iFrame**
* Launching within a [mobile app](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/scof_passkey_mobile_integration/index.md) via an **in-app browser**   

There are two methods for doing this:

## Option 1 : Mastercard managed authentication {#option-1--mastercard-managed-authentication}

1. Fetch Available Authentication Methods - Call the [Lookup Authentication Method API](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#lookupAccountHolderAuthenticationProfile). For example, when `authenticationMethodType = MANAGED_AUTHENTICATION`, it indicates that the PAN supports transaction authentication using passkeys. When calling the **Lookup Authentication Method API** , ensure that you include a value for `authenticationReasons` = **'ENROL_FINANCIAL_INSTRUMENT'** OR **'CONSUMER_IDENTITY_VALIDATION'** OR **'TRANSACTION_AUTHENTICATION'** .   

2. Retrieve the authentication UI URL (`uri`) from the response of the [Authenticate API](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#cccountHolderAuthenticationsAuthenticateProfile) . Ensure that all required fields are provided in the request.

```json
{
  "body": {
    "srcClientId": "13435294-fa4e-4acb-8fe6-05ab66b08881",
    "serviceId": "SECURE_COF_COMMERCE_PLATFORM#START_CPD_STG#01",
    "srcCorrelationId": "c3c3fc36-bc37-418f-bbbc-591dc2791178",
    "srcDigitalCardId": "EVnHnwc5QBmzzxDwYTIspA000000000000GB",
    "authenticationMethod": {
      "authenticationMethodType": "MANAGED_AUTHENTICATION",
      "authenticationSubject": "CARDHOLDER"
    },
    "authenticationContext": {
      "authenticationReasons": [
        "TRANSACTION_AUTHENTICATION"
      ],
      "dpaData": {
        "dpaPresentationName": "Mastercard MTT Integrated - DPA 3 COF",
        "dpaName": "dpa3_of_MTT Integrated SRCI COF",
        "acquirerId": "550e8400",
        "acquirerBin": "44444"
      },
      "dpaTransactionOptions": {
        "transactionAmount": {
          "transactionAmount": 9.19,
          "transactionCurrencyCode": "USD"
        },
        "merchantName": "START",
        "merchantCategoryCode": "0008",
        "merchantCountryCode": "US",
        "threeDsInputData": {
          "forceChallenge": false,
          "billingAddress": {}
        },
        "dpaLocale": "en_AU"
      },
      "consumerDeviceData": {
        "appInstanceId": "8c55b3bc-349c-4f0f-8daf-9f2787cb6d74",
        "spcEnabled": false
      },
      "callbackUri": {
        "uri": "https://eta-macs-test-tools.apps.stl.pcfstage00.mastercard.int/macstools/auth-processing?clientSessionId=a5132a4b-3578-41a8-8bbd-55ace74ea893",
        "uriType": "WEB_URI"
      }
    }
  },
  "headers": {
    "X-Src-Cx-Flow-Id": "34f4a04b.c5deb17f-a130-4ba7-a000-5bf7c33c75db.1758142793"
  }
}
```

```json
{
  "body": {
    "srcCorrelationId": "c3c3fc36-bc37-418f-bbbc-591dc2791178",
    "authenticationSessionId": "8ac870af-e9f3-4af5-9a45-184e5086a221",
    "authenticationResult": "NOT_AUTHENTICATED",
    "authenticationStatus": "PENDING",
    "methodAttributes": {
      "uriData": {
        "uri": "https://stage.src.mastercard.com/auth?sav=ZXlKcmFXUWlPaUl5TURJek1ERXlOakV4TkRNME5TMXpkR2N0YldNdGJtVjNMV2xrWlc1MGFYUjVMWFpsY21sbWFXTmhkR2x2YmkxemNtTXRiV0Z6ZEdWeVkyRnlaQzFwYm5RaUxDSjBlWEFpT2lKS1YxUXJaWGgwTG5ObGMzTnBiMjVwWkY5MGIydGxiaUlzSW1Gc1p5STZJbEpUTWpVMkluMC5leUpoZFdRaU9pSm9kSFJ3Y3pwY0wxd3ZiV0Z6ZEdWeVkyRnlaQzVqYjIwaUxDSmpiMjV6ZFcxbGNrbGtJam9pTVRNME16VXlPVFF0Wm1FMFpTMDBZV05pTFRobVpUWXRNRFZoWWpZMllqQTRPRGd4SWl3aWFYTnpJam9pYUhSMGNITTZYQzljTDIxaGMzUmxjbU5oY21RdVkyOXRJaXdpYzJOdmNHVkVZWFJoSWpvaWUxd2lZWFYwYUZObGMzTnBiMjVKWkZ3aU9sd2lPR0ZqT0Rjd1lXWXRaVGxtTXkwMFlXWTFMVGxoTkRVdE1UZzBaVFV3T0RaaE1qSXhYQ0lzWENKemNtTkRiR2xsYm5SSlpGd2lPbHdpTVRNME16VXlPVFF0Wm1FMFpTMDBZV05pTFRobVpUWXRNRFZoWWpZMllqQTRPRGd4WENJc1hDSnpjbU5EYjNKeVpXeGhkR2x2Ymtsa1hDSTZYQ0pqTTJNelptTXpOaTFpWXpNM0xUUXhPR1l0WW1KaVl5MDFPVEZrWXpJM09URXhOemhjSW4waUxDSmxlSEFpT2pFM05UZ3hOREl5TVRBc0ltbGhkQ0k2TVRjMU9ERTBNVGt4TUN3aWFuUnBJam9pWlRZeU0yUmpOakF0WkRRNU5TMDBaVFExTFdFeE5XUXRaV0V6TjJGa1l6azJNekpqSW4wLlQtNGhSQ3VmblM0WGZONmhVcjRwZnZkZEFHODJoOGExWldHWE9tOHhVRmV0V3E1dUFfZTkxX1VfdFhhQ0dNLXd5aDlVVlNObXlvUnhkSTJhaGVzV0cwdWNhVEhrVWtFb0EtT3lXeU1QRGN0aE04eWtOdWFSbjlZOGRIZkNfRy1MeFprUThxckdiLWc0VTdXNzhaMDVlZXBXam1acS1hZmkwYTU5UEtJOEpPQmtkZUc0Q19pdFZIR1B0TV9uaHE4WEhNUDZkZjYzN3pscmp4YVRCamNJUjlyVm9aZklJcUQyYXQyYVlJdzc2TFZOMjhLUFFtU2Nmd0NydWUwRmRkcUJndFcwTmFmNWRmWVF3SGRHX2laSzB3MW83Y05SajB6MEJCblp6ckRmcEh2YkxJVUdNLTZ1Z0NLb0g1Qll2cGdLdURmWG1tS091dmVwWmZMY1R0b3dVQQ==&traceId=34f4a04b.c5deb17f-a130-4ba7-a000-5bf7c33c75db.1758142793",
        "uriType": "WEB_URI"
      }
    },
    "sessionAssuranceValue": "ZXlKcmFXUWlPaUl5TURJek1ERXlOakV4TkRNME5TMXpkR2N0YldNdGJtVjNMV2xrWlc1MGFYUjVMWFpsY21sbWFXTmhkR2x2YmkxemNtTXRiV0Z6ZEdWeVkyRnlaQzFwYm5RaUxDSjBlWEFpT2lKS1YxUXJaWGgwTG5ObGMzTnBiMjVwWkY5MGIydGxiaUlzSW1Gc1p5STZJbEpUTWpVMkluMC5leUpoZFdRaU9pSm9kSFJ3Y3pwY0wxd3ZiV0Z6ZEdWeVkyRnlaQzVqYjIwaUxDSmpiMjV6ZFcxbGNrbGtJam9pTVRNME16VXlPVFF0Wm1FMFpTMDBZV05pTFRobVpUWXRNRFZoWWpZMllqQTRPRGd4SWl3aWFYTnpJam9pYUhSMGNITTZYQzljTDIxaGMzUmxjbU5oY21RdVkyOXRJaXdpYzJOdmNHVkVZWFJoSWpvaWUxd2lZWFYwYUZObGMzTnBiMjVKWkZ3aU9sd2lPR0ZqT0Rjd1lXWXRaVGxtTXkwMFlXWTFMVGxoTkRVdE1UZzBaVFV3T0RaaE1qSXhYQ0lzWENKemNtTkRiR2xsYm5SSlpGd2lPbHdpTVRNME16VXlPVFF0Wm1FMFpTMDBZV05pTFRobVpUWXRNRFZoWWpZMllqQTRPRGd4WENJc1hDSnpjbU5EYjNKeVpXeGhkR2x2Ymtsa1hDSTZYQ0pqTTJNelptTXpOaTFpWXpNM0xUUXhPR1l0WW1KaVl5MDFPVEZrWXpJM09URXhOemhjSW4waUxDSmxlSEFpT2pFM05UZ3hOREl5TVRBc0ltbGhkQ0k2TVRjMU9ERTBNVGt4TUN3aWFuUnBJam9pWlRZeU0yUmpOakF0WkRRNU5TMDBaVFExTFdFeE5XUXRaV0V6TjJGa1l6azJNekpqSW4wLlQtNGhSQ3VmblM0WGZONmhVcjRwZnZkZEFHODJoOGExWldHWE9tOHhVRmV0V3E1dUFfZTkxX1VfdFhhQ0dNLXd5aDlVVlNObXlvUnhkSTJhaGVzV0cwdWNhVEhrVWtFb0EtT3lXeU1QRGN0aE04eWtOdWFSbjlZOGRIZkNfRy1MeFprUThxckdiLWc0VTdXNzhaMDVlZXBXam1acS1hZmkwYTU5UEtJOEpPQmtkZUc0Q19pdFZIR1B0TV9uaHE4WEhNUDZkZjYzN3pscmp4YVRCamNJUjlyVm9aZklJcUQyYXQyYVlJdzc2TFZOMjhLUFFtU2Nmd0NydWUwRmRkcUJndFcwTmFmNWRmWVF3SGRHX2laSzB3MW83Y05SajB6MEJCblp6ckRmcEh2YkxJVUdNLTZ1Z0NLb0g1Qll2cGdLdURmWG1tS091dmVwWmZMY1R0b3dVQQ==",
    "authenticationSessionExpiry": "1758228310562"
  },
  "headers": {
    "X-SRC-CX-FLOW-ID": "34f4a04b.c5deb17f-a130-4ba7-a000-5bf7c33c75db.1758142810"
  }
}
```

3. Redirect the user to the authentication UI URL (`uri`) to perform managed authentication, and capture the authentication status via the HTTPS `callbackUri`.

````javascript
// Example Authentication URL
https://sandbox.src.mastercard.com/auth?sav=ZXlKcmFXUWlPaUl5TURJek1ERXlOakV4TkRNME5TMXpkR2N0YldNdGJtVjNMV2xrWlc1MGFYUjVMWFpsY21sbWFXTmhkR2x2YmkxemNtTXRiV0Z6ZEdWeVkyRnlaQzFwYm5RaUxDSjBlWEFpT2lKS1YxUXJaWGgwTG5ObGMzTnBiMjVwWkY5MGIydGxiaUlzSW1Gc1p5STZJbEpUTWpVMkluMC5leUpoZFdRaU9pSm9kSFJ3Y3pwY0wxd3ZiV0Z6ZEdWeVkyRnlaQzVqYjIwaUxDSmpiMjV6ZFcxbGNrbGtJam9pTVRNME16VXlPVFF0Wm1FMFpTMDBZV05pTFRobVpUWXRNRFZoWWpZMllqQTRPRGd4SWl3aWFYTnpJam9pYUhSMGNITTZYQzljTDIxaGMzUmxjbU5oY21RdVkyOXRJaXdpYzJOdmNHVkVZWFJoSWpvaWUxd2lZWFYwYUZObGMzTnBiMjVKWkZ3aU9sd2lPR0ZqT0Rjd1lXWXRaVGxtTXkwMFlXWTFMVGxoTkRVdE1UZzBaVFV3T0RaaE1qSXhYQ0lzWENKemNtTkRiR2xsYm5SSlpGd2lPbHdpTVRNME16VXlPVFF0Wm1FMFpTMDBZV05pTFRobVpUWXRNRFZoWWpZMllqQTRPRGd4WENJc1hDSnpjbU5EYjNKeVpXeGhkR2x2Ymtsa1hDSTZYQ0pqTTJNelptTXpOaTFpWXpNM0xUUXhPR1l0WW1KaVl5MDFPVEZrWXpJM09URXhOemhjSW4waUxDSmxlSEFpT2pFM05UZ3hOREl5TVRBc0ltbGhkQ0k2TVRjMU9ERTBNVGt4TUN3aWFuUnBJam9pWlRZeU0yUmpOakF0WkRRNU5TMDBaVFExTFdFeE5XUXRaV0V6TjJGa1l6azJNekpqSW4wLlQtNGhSQ3VmblM0WGZONmhVcjRwZnZkZEFHODJoOGExWldHWE9tOHhVRmV0V3E1dUFfZTkxX1VfdFhhQ0dNLXd5aDlVVlNObXlvUnhkSTJhaGVzV0cwdWNhVEhrVWtFb0EtT3lXeU1QRGN0aE04eWtOdWFSbjlZOGRIZkNfRy1MeFprUThxckdiLWc0VTdXNzhaMDVlZXBXam1acS1hZmkwYTU5UEtJOEpPQmtkZUc0Q19pdFZIR1B0TV9uaHE4WEhNUDZkZjYzN3pscmp4YVRCamNJUjlyVm9aZklJcUQyYXQyYVlJdzc2TFZOMjhLUFFtU2Nmd0NydWUwRmRkcUJndFcwTmFmNWRmWVF3SGRHX2laSzB3MW83Y05SajB6MEJCblp6ckRmcEh2YkxJVUdNLTZ1Z0NLb0g1Qll2cGdLdURmWG1tS091dmVwWmZMY1R0b3dVQQ==&amp;traceId=34f4a04b.c5deb17f-a130-4ba7-a000-5bf7c33c75db.1758142793 ``` 

// Https callbackUri Example with base64 encoded authentication status 
https://stage.mcsrcteststore.com/macstools/auth-processing?&res=eyJyZXN1bHQiOiJBVVRIRU5USUNBVElPTl9TVUNDRVNTIiwicmVxdWlyZUFkZGl0aW9uYWxBdXRoIjpmYWxzZSwiYXV0aGVudGljYXRpb25TZXNzaW9uSWQiOiJmYTY3Yjc4Yy1hMWZkLTQyYTQtYTg5MS1mZDdmODE1MDgxZmQifQ%3D%3D  
````

Note: In some instances you may not receive the callback URL containing the authentication status, for example, due to network connectivity issues. To confirm authentication is successful, it is essential to complete step 4 to retrieve the authentication assurance data from from the Authenticate API response prior to taking further action.

4. Once the authentication status is received via `callbackUri`, retrieve the proof of authentication (`assuranceData`) from the response of the **Authenticate API**. Make sure all required fields are included in the request.

```json
{
  "body": {
    "srcClientId": "13435294-fa4e-4acb-8fe6-05ab66b08881",
    "serviceId": "SECURE_COF_COMMERCE_PLATFORM#START_CPD_STG#01",
    "srcCorrelationId": "dae7a75c-a8fe-4469-90a8-66033e4798a4",
    "srcDigitalCardId": "2QXmbgiVSyy9Im-La45iUQ000000000000US",
    "authenticationSessionId": "3c4908a8-edcc-43b0-9d95-57c3e6821ce6",
    "authenticationMethod": {
      "authenticationMethodType": "MANAGED_AUTHENTICATION",
      "authenticationSubject": "CARDHOLDER"
    }
  },
  "headers": {
    "X-Src-Cx-Flow-Id": "34f4a04b.bddf2b43-0e31-42c1-afc7-88d155feaa22.1758314236"
  }
}
```

```json
{
  "body": {
    "srcCorrelationId": "dae7a75c-a8fe-4469-90a8-66033e4798a4",
    "authenticationSessionId": "3c4908a8-edcc-43b0-9d95-57c3e6821ce6",
    "authenticationResult": "AUTHENTICATED",
    "authenticationStatus": "COMPLETE",
    "assuranceData": {
      "verificationData": [
        {
          "verificationType": "CARDHOLDER",
          "verificationEntity": "02",
          "verificationMethod": "07",
          "verificationResults": "01",
          "verificationTimestamp": "1758313379228",
          "verificationEvents": [
            "01"
          ],
          "additionalData": "eyJ0eXBlIjoiRklETzIiLCJjZXJ0aWZpZWRNZmFNZXRob2RJZCI6IjIwMDAxIiwibWZhTWV0aG9kSW5zdGFuY2VJZCI6InM0eWRYdzQ3VExPYnNKS3VTZE9rT3cwMDAwMDAwMDAwMTBVUyIsImFzc2VydGlvbiI6ImV5SnJhV1FpT2lJeU1ESXpNREV5TmpFeE5ETTBOUzF6ZEdjdGJXTXRibVYzTFdsa1pXNTBhWFI1TFhabGNtbG1hV05oZEdsdmJpMXpjbU10YldGemRHVnlZMkZ5WkMxcGJuUWlMQ0owZVhBaU9pSktWMVFyWlhoMExtTmhjbVJmZEc5clpXNGlMQ0poYkdjaU9pSlNVekkxTmlKOS5leUpoZFdRaU9pSm9kSFJ3Y3pwY0wxd3ZiV0Z6ZEdWeVkyRnlaQzVqYjIwaUxDSmpiMjV6ZFcxbGNrbGtJam9pTVRNME16VXlPVFF0Wm1FMFpTMDBZV05pTFRobVpUWXRNRFZoWWpZMllqQTRPRGd4SWl3aWFYTnpJam9pYUhSMGNITTZYQzljTDIxaGMzUmxjbU5oY21RdVkyOXRJaXdpYzJOdmNHVkVZWFJoSWpvaWUxd2lZWFYwYUZObGMzTnBiMjVKWkZ3aU9sd2lPR0ZqT0Rjd1lXWXRaVGxtTXkwMFlXWTFMVGxoTkRVdE1UZzBaVFV3T0RaaE1qSXhYQ0lzWENKemNtTkRiR2xsYm5SSlpGd2lPbHdpTVRNME16VXlPVFF0Wm1FMFpTMDBZV05pTFRobVpUWXRNRFZoWWpZMllqQTRPRGd4WENJc1hDSnpjbU5EYjNKeVpXeGhkR2x2Ymtsa1hDSTZYQ0pqTTJNelptTXpOaTFpWXpNM0xUUXhPR1l0WW1KaVl5MDFPVEZrWXpJM09URXhOemhjSW4waUxDSmxlSEFpT2pFM05UZ3hOREl5TVRBc0ltbGhkQ0k2TVRjMU9ERTBNVGt4TUN3aWFuUnBJam9pWlRZeU0yUmpOakF0WkRRNU5TMDBaVFExTFdFeE5XUXRaV0V6TjJGa1l6azJNekpqSW4wLlQtNGhSQ3VmblM0WGZONmhVcjRwZnZkZEFHODJoOGExWldHWE9tOHhVRmV0V3E1dUFfZTkxX1VfdFhhQ0dNLXd5aDlVVlNObXlvUnhkSTJhaGVzV0cwdWNhVEhrVWtFb0EtT3lXeU1QRGN0aE04eWtOdWFSbjlZOGRIZkNfRy1MeFprUThxckdiLWc0VTdXNzhaMDVlZXBXam1acS1hZmkwYTU5UEtJOEpPQmtkZUc0Q19pdFZIR1B0TV9uaHE4WEhNUDZkZjYzN3pscmp4YVRCamNJUjlyVm9aZklJcUQyYXQyYVlJdzc2TFZOMjhLUFFtU2Nmd0NydWUwRmRkcUJndFcwTmFmNWRmWVF3SGRHX2laSzB3MW83Y05SajB6MEJCblp6ckRmcEh2YkxJVUdNLTZ1Z0NLb0g1Qll2cGdLdURmWG1tS091dmVwWmZMY1R0b3dVQQ=="
        }
      ]
    }
  },
  "headers": {
    "X-SRC-CX-FLOW-ID": "34f4a04b.bddf2b43-0e31-42c1-afc7-88d155feaa22.1758314279"
  }
}
```

5. Use the payment authentication `assuranceData` for completing the Checkout.

## Option 2 : Integrator managed authentication {#option-2--integrator-managed-authentication}

1. Fetch Available Authentication Methods - Call the [Lookup Authentication Method API](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#lookupAccountHolderAuthenticationProfile) with applicable authenticationReasons (one of `ENROLL_FINANCIAL_INSTRUMENT` for card add or `CONSUMER_IDENTITY_VALIDATION` for verify account use case, and `AUTHENTICATOR_REGISTRATION`) and inspect the response to identify available authenticationMethods.

Check `authenticationMethods.authenticationMethodType` per table below to identify ID\&V eligibility.

|        Method Type        |                                                         Description                                                          |
|---------------------------|------------------------------------------------------------------------------------------------------------------------------|
| **SMS_OTP**               | OTP sent to the Cardholder's phone number registered with the Issuer                                                         |
| **EMAIL_OTP**             | OTP sent to the Cardholder's email address registered with the Issuer                                                        |
| **ISSUER_RBA**            | Risk-based authentication assessed by the Issuer; may result in frictionless approval or a declined authentication request   |
| **APP_AUTHENTICATION**    | Issuer Mobile Banking app launched by the Integrator using a deep-link/Android intent with an Integrator callback URL        |
| **APP_PUSH_NOTIFICATION** | Issuer Mobile Banking app opened when the Cardholder interacts with a Push Notification sent by the Issuer                   |
| **ONBEHALF_ISSUER_IDV**   | Mastercard-hosted ID\&V flow using channels provided by the Issuer; equivalent app-based APP_AUTHENTICATION is not supported |

<br />

Note: Ensure that the `authenticationReasons` field includes **two values** ---one for **Card Add or Verify Account** and another for **Authenticator Registration** ---when invoking the **Lookup Authentication Method** API.

2. Perform ID\&V - Call the [Authenticate API](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#authentication) to perform ID\&V. You can request:
   * **OTP**
   * **App Authentication link**
   * **Push Notification to App**
   * **Check results** or
   * **Risk-Based Authentication (Issuer RBA)**

Ensure that **all required fields** are included in the request.

```json
{
  "body": {
    "srcClientId": "13435294-fa4e-4acb-8fe6-05ab66b08881",
    "serviceId": "SECURE_COF_COMMERCE_PLATFORM#START_CPD_STG#01",
    "srcCorrelationId": "c3c3fc36-bc37-418f-bbbc-591dc2791178",
    "srcDigitalCardId": "EVnHnwc5QBmzzxDwYTIspA000000000000GB",
    "authenticationMethod": {
      "authenticationMethodType": "SMS_OTP",
      "authenticationSubject": "CARDHOLDER"
    },
    "authenticationContext": {
      "authenticationReasons": ["ENROLL_FINANCIAL_INSTRUMENT"],
      "dpaData": {
        "dpaPresentationName": "Mastercard MTT Integrated - DPA 3 COF",
        "dpaName": "dpa3_of_MTT Integrated SRCI COF"
      },
      "dpaTransactionOptions": {
        "merchantName": "SAMPLE_MERCHANT",
        "dpaLocale": "en_AU"
      }
    }
  },
  "headers": {
    "X-Src-Cx-Flow-Id": "34f4a04b.c5deb17f-a130-4ba7-a000-5bf7c33c75db.1758142793"
  }
}
```

```json
{
  "body": {
    "srcCorrelationId": "c3c3fc36-bc37-418f-bbbc-591dc2791178",
    "authenticationSessionId": "8ac870af-e9f3-4af5-9a45-184e5086a221",
    "authenticationResult": "NOT_AUTHENTICATED",
    "authenticationStatus": "PENDING",
    "methodAttributes": {
      "uriData": {
        "uri": "https://stage.src.mastercard.com/auth?sav=ZXlKcmFXUWlPaUl5TURJek1ERXlOakV4TkRNME5TMXpkR2N0YldNdGJtVjNMV2xrWlc1MGFYUjVMWFpsY21sbWFXTmhkR2x2YmkxemNtTXRiV0Z6ZEdWeVkyRnlaQzFwYm5RaUxDSjBlWEFpT2lKS1YxUXJaWGgw...",
        "uriType": "WEB_URI"
      }
    },
    "sessionAssuranceValue": "ZXlKcmFXUWlPaUl5TURJek1ERXlOakV4TkRNME5TMXpkR2N0..."
  },
  "headers": {
    "X-SRC-CX-FLOW-ID": "34f4a04b.c5deb17f-a130-4ba7-a000-5bf7c33c75db.1758142810"
  }
}
```

> **Note:** If `authenticationMethods.authenticationMethodType` = **ISSUER_RBA**, then Step 3 below can be skipped.

3. After the consumer has entered an OTP or completed App Authentication or used Push Notification App Authentication, call the **Authenticate API** again to request **proof of authentication** and `assuranceData`.

```json
{
  "body": {
    "srcClientId": "13435294-fa4e-4acb-8fe6-05ab66b08881",
    "serviceId": "SECURE_COF_COMMERCE_PLATFORM#START_CPD_STG#01",
    "srcCorrelationId": "c3c3fc36-bc37-418f-bbbc-591dc2791178",
    "srcDigitalCardId": "EVnHnwc5QBmzzxDwYTIspA000000000000GB",
    "authenticationMethod": {
      "authenticationMethodType": "SMS_OTP",
      "authenticationSubject": "CARDHOLDER"
    },
    "authenticationContext": {
      "authenticationReasons": ["ENROLL_FINANCIAL_INSTRUMENT"],
      "dpaData": {
        "dpaPresentationName": "Mastercard MTT Integrated - DPA 3 COF",
        "dpaName": "dpa3_of_MTT Integrated SRCI COF"
      },
      "dpaTransactionOptions": {
        "merchantName": "SAMPLE_MERCHANT",
        "dpaLocale": "en_AU"
      }
    }
  },
  "headers": {
    "X-Src-Cx-Flow-Id": "34f4a04b.c5deb17f-a130-4ba7-a000-5bf7c33c75db.1758142793"
  }
}
```

```json
{
  "body": {
    "srcCorrelationId": "c3c3fc36-bc37-418f-bbbc-591dc2791178",
    "authenticationSessionId": "8ac870af-e9f3-4af5-9a45-184e5086a221",
    "authenticationResult": "NOT_AUTHENTICATED",
    "authenticationStatus": "PENDING",
    "methodAttributes": {
      "uriData": {
        "uri": "https://stage.src.mastercard.com/auth?sav=ZXlKcmFXUWlPaUl5TURJek1ERXlOakV4TkRNME5TMXpkR2N0YldNdGJtVjNMV2xrWlc1MGFYUjVMWFpsY21sbWFXTmhkR2x2YmkxemNtTXRiV0Z6ZEdWeVkyRnlaQzFwYm5RaUxDSjBlWEFpT2lKS1YxUXJaWGgw...",
        "uriType": "WEB_URI"
      }
    },
    "sessionAssuranceValue": "ZXlKcmFXUWlPaUl5TURJek1ERXlOakV4TkRNME5TMXpkR2N0..."
  },
  "headers": {
    "X-SRC-CX-FLOW-ID": "34f4a04b.c5deb17f-a130-4ba7-a000-5bf7c33c75db.1758142810"
  }
}
```

4. Passkey Registration -- Retrieve Authentication UI URL - Call the **Authenticate API** and extract the `uri` from the response. This `uri` represents the **Authentication UI URL** that the integrator must launch or redirect the user to. Make sure **all required fields** are included in the request.

```json
{
  "body": {
    "srcClientId": "13435294-fa4e-4acb-8fe6-05ab66b08881",
    "serviceId": "SECURE_COF_COMMERCE_PLATFORM#START_CPD_STG#01",
    "srcCorrelationId": "c3c3fc36-bc37-418f-bbbc-591dc2791178",
    "srcDigitalCardId": "EVnHnwc5QBmzzxDwYTIspA000000000000GB",
    "authenticationMethod": {
      "authenticationMethodType": "FIDO2",
      "authenticationSubject": "CARDHOLDER"
    },
    "authenticationContext": {
      "authenticationReasons": ["AUTHENTICATOR_REGISTRATION"],
      "dpaData": {
        "dpaPresentationName": "Mastercard MTT Integrated - DPA 3 COF",
        "dpaName": "dpa3_of_MTT Integrated SRCI COF",
        "acquirerId": "550e8400",
        "acquirerBin": "44444"
      },
      "dpaTransactionOptions": {
        "merchantName": "START",
        "merchantCategoryCode": "0008",
        "merchantCountryCode": "US",
        "threeDsInputData": {
          "forceChallenge": false,
          "billingAddress": {}
        },
        "dpaLocale": "en_AU"
      },
      "consumerDeviceData": {
        "appInstanceId": "8c55b3bc-349c-4f0f-8daf-9f2787cb6d74",
        "spcEnabled": false
      },
      "callbackUri": {
        "uri": "https://eta-macs-test-tools.apps.stl.pcfstage00.mastercard.int/macstools/auth-processing?clientSessionId=a5132a4b-3578-41a8-8bbd-55ace74ea893",
        "uriType": "WEB_URI"
      }
    }
  },
  "headers": {
    "X-Src-Cx-Flow-Id": "34f4a04b.c5deb17f-a130-4ba7-a000-5bf7c33c75db.1758142793"
  }
}
```

```json
{
  "body": {
    "srcCorrelationId": "c3c3fc36-bc37-418f-bbbc-591dc2791178",
    "authenticationSessionId": "8ac870af-e9f3-4af5-9a45-184e5086a221",
    "authenticationResult": "NOT_AUTHENTICATED",
    "authenticationStatus": "PENDING",
    "methodAttributes": {
      "uriData": {
        "uri": "https://stage.src.mastercard.com/auth?sav=ZXlKcmFXUWlPaUl5TURJek1ERXlOakV4TkRNME5TMXpkR2N0YldNdGJtVjNMV2xrWlc1MGFYUjVMWFpsY21sbWFXTmhkR2x2YmkxemNtTXRiV0Z6ZEdWeVkyRnlaQzFwYm5RaUxDSjBlWEFpT2lKS1YxUXJaWGgw...",
        "uriType": "WEB_URI"
      }
    },
    "sessionAssuranceValue": "ZXlKcmFXUWlPaUl5TURJek1ERXlOakV4TkRNME5TMXpkR2N0..."
  },
  "headers": {
    "X-SRC-CX-FLOW-ID": "34f4a04b.c5deb17f-a130-4ba7-a000-5bf7c33c75db.1758142810"
  }
}
```

5. Launch the Authentication UI Redirect or launch the **Authentication UI URL (`uri`)** to perform **Passkey Registration** . The authentication status will be sent via the configured HTTPS `callbackUri`.

```javascript
Example Authentication URL

https://sandbox.src.mastercard.com/auth?sav=ZXlKcmFXUWlPaUl5TURJek1ERXlOakV4TkRNME5TMXpkR2N0YldN...
```

6. Receive Authentication Callback After authentication is completed, Mastercard sends a **Base64-encoded authentication status** to your callback endpoint.

```javascript
Example Callback URI 
https://stage.mcsrcteststore.com/macstools/auth-processing?res=eyJyZXN1bHQiOiJBVVRIRU5USUNBVElPTl9TVUNDRVNTIiwicmVxdWlyZUFkZGl0aW9uYWxBdXRoIjpmYWxzZSwiYXV0aGVudGljYXRpb25TZXNzaW9uSWQiOiJmYTY3Yjc4Yy1hMWZkLTQyYTQtYTg5MS1mZDdmODE1MDgxZmQifQ%3D%3D
```

7. Retrieve Proof of Authentication Once the callback status is received, call the **Authenticate API** again to fetch the **proof of authentication (`assuranceData`)**. Ensure all required parameters are included.

> **Note:** The **ID\&V** and **Passkey Registration** steps can be performed in any order, but both must be completed **before Step 8 -- Bind**.

8. Bind Passkey to Consumer Device
   Call the **Authenticators API** and provide both the **proof of authentication** and **assuranceData** to bind the Passkey to the Consumer's device.

9. Complete Secure Card on File Checkout without Authentication
   Returning consumers on the same device can use the Passkey created in this process to perform **payment authentication** for completing the checkout.

## Launch Auth UI {#launch-auth-ui}

Integrators can utilize our SDK to invoke the Authentication UI.

1. Fetch the `authenticationMethods` available in the response of [Enroll Card](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#card), [Get Cards](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#card) or [Lookup Authentication Method](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#authentication) API endpoints to launch the Authentication UI.

* For example, `authenticationMethodType` = MANAGED_AUTHENTICATION indicates that transaction authentication is supported using passkey for the PAN.
* Ensure that you pass a value in `authenticationReasons` while calling Lookup Authentication Method API.   

2. Implement the JavaScript library into your application using one of these URLs (for either Sandbox or Production environments):   
   The `sdk.js` is provided as JavaScript code. Use a script tag in the `<head>` of the HTML page.

| Environment |                        Script tag containing the URL                        |                                                                                                          Description                                                                                                           |
|-------------|-----------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Sandbox     | `<script src="https://sandbox.src.mastercard.com/auth/js/sdk.js"></script>` | Sandbox credentials available in [Mastercard Connect](https://www.mastercardconnect.com/) are useful for testing the integration. Checkouts made in this environment are simulated and do not reflect your Production records. |
| Production  | `<script src="https://src.mastercard.com/auth/js/sdk.js"></script> `        | Upon successful integration testing, you can then request for Production credentials. You can change your initialization to use Production environment to start accepting live transactions.                                   |

3. Call the [authenticate()](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/sdk-reference/authenticate/index.md) method via the following window:

      NAMESPACE = window.AUTHSDK_MASTERCARD.<method>

4. Mastercard responds with the payload containing authentication result and status.

```javascript
{
  authenticationStatus: 'COMPLETE',
  authenticationResult: 'AUTHENTICATED',
  assuranceData: {
      verificationData: [{
        verificationType: 'CARDHOLDER',
        verificationEntity: '03',
        verificationMethod: '01',
        verificationResults: '01',
        verificationTimestamp: '2023-02-13T14:18:40.968Z',
        verificationEvents: ['02'],
        additionalData: 'eyJraWQiOiIxNDkwMjQtc3RnLXNyYy1pZGVudGl0eS12ZXJpZmljYXRpb24iLCJ0eXAiOiJKV1QrZXh0LmNhcmRfdG9rZW4iLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJodHRwczpcL1wvbWFzdGVyY2FyZC5jb20iLCJjYXJkSWQiOiI3NWZlOGFlYi1hMGM0LTQ1Y2UtODMxMy1kZGU2YmI1ZTZjNGUiLCJpc3MiOiJodHRwczpcL1wvbWFzdGVyY2FyZC5jb20iLCJjb3JyZWxhdGlvbklkIjoiNmNiMDVkYWMtNzJlZS00M2E2LTgwMmQtMzQ0NDM1NDQ4OGJmIiwic2NvcGVEYXRhIjoie1wiYXV0aFNlc3Npb25JZFwiOlwiN2RiMGQyMzUtNDQwZS00ZTdjLWI5NDAtNGJhY2YxMDc4MzFiXCIsXCJhdXRoZW50aWNhdGlvblJlc3VsdFwiOlwiQVVUSEVOVElDQVRFRFwiLFwiYXV0aGVudGljYXRpb25NZXRob2RcIjpcIjNEU1wiLFwic3JjaUNsaWVudElkXCI6XCJjZTgxMjJhZS04OGJiLTQ1MzctODdmZS04ZTU2Zjk0NzVjYjRcIixcInRocmVlRHNQQVZlcmlmaWVkXCI6XCJ0cnVlXCIsXCJhdXRoZW50aWNhdGlvblRpbWVcIjpcIjIwMjMtMDItMTNUMTQ6MTg6NDAuOTc2WlwiLFwiYXV0aGVudGljYXRpb25SZWFzb25zXCI6W1wiRU5ST0xfRklOQU5DSUFMX0lOU1RSVU1FTlRcIl19IiwiZXhwIjoxNjc2Mjk4MjIwLCJpYXQiOjE2NzYyOTc5MjAsImp0aSI6IjMyMzA0NmM4LTMyMjQtNGE3Zi04NDM3LTA2OGI5ZmE5MmJlMCJ9.to4jlDd3CFPM_ucB9jbCP8_i0xFCFLCOZhHjadO0VZ3keOub0k4fmn_fLw1XZG5U0B8CZMXdsWS_wjBgJ4jaiv_nVF--i_29-YyeQ7BPg6oIPGpEXDEhqxl4ZeeY7quMrMhh2nbupkcHcyB36dCK285D-BLhVtXhed4S1KK-qr6qcOJ76qnDZlDNSx2rIvXwChslXBXFwpPij9JxjKcjv5RWL0qAUXMxKQE8Gf0ZnB_bVZQxRDzw-1CWhKMIyShzahoDJI9dRzKSv-c1xwzz5wTn6FhctGAOk0Sd6KsUIrCBw3W3MXd0uWQXDOhvuYA0aZX9GMRFpOP5penmZNlUaA'
      }]
    },
    srcCorrelationId: '6cb05dac-72ee-43a6-802d-3444354488bf'
}
```

<br />

## Perform Authentication {#perform-authentication}

Request transaction authentication while adding a card or performing checkout.

* [Option 1](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/integrate_apis_scof/step5/index.md#option-1-perform-authentication-using-passkey): Perform Authentication using Passkey
* [Option 2](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/integrate_apis_scof/step5/index.md#option-2-perform-authentication-using-a-preferred-method): Perform Authentication using a Preferred Method

## Option 1: Perform Authentication using Passkey {#option-1-perform-authentication-using-passkey}

Mastercard allows the cardholders to create a passkey and the Integrators to use these passkeys for authenticating a transaction.

1. Launch the Mastercard [Authentication UI](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/integrate_apis_scof/step4/index.md) to perform Identity and Verification (ID\&V).   
   The authentication request must comprise of:

* `authenticationMethodType` = MANAGED_AUTHENTICATION
* `authenticationReasons` = ENROL_FINANCIAL_INSTRUMENT or CONSUMER_IDENTITY_VALIDATION or TRANSACTION_AUTHENTICATION
* `transactionAmount` \> 0 and other required parameters
* Mandatory data fields: **acquirerMerchantId** /**acquirerId** , **acquirerBIN** , **merchantCategoryCode** , **dpaLocale** , and **merchantCountryCode**

Note: The `transactionAmount` is required for `authenticationReasons` = TRANSACTION_AUTHENTICATION.

2. If a passkey is not present, Mastercard initiates 3DS authentication.   
   Once the ID\&V is successful, the cardholder is prompted to create a passkey.

3. If a passkey exists, Integrator prompts the cardholder for authentication.

4. Mastercard authenticates the transaction using the passkey and shares the results in `authenticationResult`= AUTHENTICATED and `authenticationStatus`= COMPLETE within `assuranceData` with the Integrator, detailed out [here](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/integrate_apis_scof/step5/index.md).

5. Pass these authentication results in the [Checkout API](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/integrate_apis_scof/step7/index.md) call.

For more information on the use cases, see cases [Authentication by Mastercard (TAS)](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/token-authentication/secure-card-on-file/by-mastercard/index.md).

## Option 2: Perform Authentication using a Preferred Method {#option-2-perform-authentication-using-a-preferred-method}

To perform authentication using Issuer supported methods (3DS), follow these steps:

1. Launch the Mastercard [Authentication UI](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/integrate_apis_scof/step4/index.md) to perform 3DS transaction authentication.   
   The authentication request must comprise of:

* `authenticationMethodType` = 3DS
* `authenticationReasons` = TRANSACTION_AUTHENTICATION
* `transactionAmount` \> 0 and other required parameters
* Mandatory data fields: **acquirerMerchantId** , **acquirerBIN** , **merchantCategoryCode** , and **merchantCountryCode**

2. The Issuer may present the challenge on the Authentication UI or a frictionless 3DS transaction authentication is done.

3. The Issuer shares the authentication results with Mastercard.

4. Upon successful 3DS transaction authentication, Mastercard shares the results in `authenticationResult`= AUTHENTICATED and `authenticationStatus`= COMPLETE within `assuranceData` with the Integrator, detailed out [here](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/integrate_apis_scof/step5/index.md).

5. Pass these authentication results in the [Checkout API](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/integrate_apis_scof/step7/index.md) call.

Use case is available [here](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/token-authentication/secure-card-on-file/by-mastercard/authentication-with-3ds/index.md).

## Launch Auth UI {#launch-auth-ui}

Integrators can utilize our URL to invoke the Authentication UI.

1. Fetch the `authenticationMethods` and `uriData.uri` available in the response of [Enroll Card](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#card), or [Lookup Authentication Method](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#authentication) API endpoint to launch the Authentication UI.

* For example, `authenticationMethodType` = MANAGED_AUTHENTICATION indicates that transaction authentication is supported using passkey for the PAN.
* Ensure that you pass a value in `authenticationReasons` while calling Lookup Authentication Method API.   

2. Create a window object. Mastercard recommends to use popup.

3. Define the initialization payload to be sent in the postMessage in Step 7.

```javascript
const payload = {

  authenticationMethod: {
        authenticationMethodType: "MANAGED_AUTHENTICATION",      
         authenticationSubject: "CARDHOLDER",
        }
  srcCorrelationId: 'a5fe8aeb-a0c4-45ce-8313-dde6bb5e6c3d',
  serviceId: "SECURE_COF_MERCHANT#TESTPROJECT_PROD-PGMNAME#01",
  srcClientId: "eccbf087-f159-4d69-b31d-00bec75c0474",
  accountReference: {
    srcDigitalCardId: '75fe8aeb-a0c4-45ce-8313-dde6bb5e6c4e'
  },
  authenticationContext: {
    authenticationReasons: ['ENROL_FINANCIAL_INSTRUMENT'],
    acquirerMerchantId: '550e8400',
    acquirerBIN: '444444',
    dpaTransactionOptions: {
      transactionAmount: {
        transactionAmount: 250,
        transactionCurrencyCode: 'USD',
                     "merchantCategoryCode":"0008",
          "merchantCountryCode":"US"
      },
      threeDsInputData: {
        billingAddress: {
          name: 'Coby Greenholt',
          'line1': '49674 Gorczany Village',
          'line2': 'Hansen Circle',
          state: 'CT',
          zip: '98410',
          countryCode: 'US'
        }
      }
    }
  }
}
```

4. Navigate to `<authenticationMethod.uriData.uri>?origin=<window.location.host> ` and load the URL in the window object.   

```javascript
// extract `uri` from methodAttributes - this is the URL to the hosted Auth UI
const { uri } = payload.authenticationMethod.methodAttributes.uriData

// load the Auth UI URL with the window origin host defined as a query string parameter
const launchUri = `${uri}?origin=${window.location.origin}`
```

5. Apply an event listener to listen to *Ready* , *Success* and *Error* postMessage events. Provide an event listener in the same webpage as the one that opened the window in step 2 to wait for a postMessage arriving from the Auth UI. The table below describes the different actions:   

|   Action    |                                                                       Description                                                                        |
|-------------|----------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Ready**   | The Auth UI is ready to receive the initial payload to initialize the authentication experience via `window.postMessage()`. Use the payload from Step 3. |
| **Success** | The Auth UI has completed the authentication experience successfully.                                                                                    |
| **Error**   | The Auth UI has failed to complete the authentication experience.                                                                                        |

6. Mastercard returns a postMessage with `action` = *Ready*.

```javascript
dictionary
{
action: 'Ready'
}
```

7. Further, send a postMessage with `action` = *Authenticate* and the payload containing required fields to perform the authentication within the window object.

```javascript
dictionary
{
  action: 'Authenticate',
  payload: {
     accountReference: AccountReference,
     authenticationContext: AuthenticationContext,
     authenticationMethod: AuthenticationMethod,
     srcCorrelationId: string,
     srciTransactionId: string
     }
}
```

8. Mastercard responds via postMessage with `action` = *Success* or *Error* and the payload containing authentication result and status.

```javascript
{
  authenticationStatus: 'COMPLETE',
  authenticationResult: 'AUTHENTICATED',
  assuranceData: {
      verificationData: [{
        verificationType: 'CARDHOLDER',
        verificationEntity: '03',
        verificationMethod: '01',
        verificationResults: '01',
        verificationTimestamp: '2023-02-13T14:18:40.968Z',
        verificationEvents: ['02'],
        additionalData: 'eyJraWQiOiIxNDkwMjQtc3RnLXNyYy1pZGVudGl0eS12ZXJpZmljYXRpb24iLCJ0eXAiOiJKV1QrZXh0LmNhcmRfdG9rZW4iLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJodHRwczpcL1wvbWFzdGVyY2FyZC5jb20iLCJjYXJkSWQiOiI3NWZlOGFlYi1hMGM0LTQ1Y2UtODMxMy1kZGU2YmI1ZTZjNGUiLCJpc3MiOiJodHRwczpcL1wvbWFzdGVyY2FyZC5jb20iLCJjb3JyZWxhdGlvbklkIjoiNmNiMDVkYWMtNzJlZS00M2E2LTgwMmQtMzQ0NDM1NDQ4OGJmIiwic2NvcGVEYXRhIjoie1wiYXV0aFNlc3Npb25JZFwiOlwiN2RiMGQyMzUtNDQwZS00ZTdjLWI5NDAtNGJhY2YxMDc4MzFiXCIsXCJhdXRoZW50aWNhdGlvblJlc3VsdFwiOlwiQVVUSEVOVElDQVRFRFwiLFwiYXV0aGVudGljYXRpb25NZXRob2RcIjpcIjNEU1wiLFwic3JjaUNsaWVudElkXCI6XCJjZTgxMjJhZS04OGJiLTQ1MzctODdmZS04ZTU2Zjk0NzVjYjRcIixcInRocmVlRHNQQVZlcmlmaWVkXCI6XCJ0cnVlXCIsXCJhdXRoZW50aWNhdGlvblRpbWVcIjpcIjIwMjMtMDItMTNUMTQ6MTg6NDAuOTc2WlwiLFwiYXV0aGVudGljYXRpb25SZWFzb25zXCI6W1wiRU5ST0xfRklOQU5DSUFMX0lOU1RSVU1FTlRcIl19IiwiZXhwIjoxNjc2Mjk4MjIwLCJpYXQiOjE2NzYyOTc5MjAsImp0aSI6IjMyMzA0NmM4LTMyMjQtNGE3Zi04NDM3LTA2OGI5ZmE5MmJlMCJ9.to4jlDd3CFPM_ucB9jbCP8_i0xFCFLCOZhHjadO0VZ3keOub0k4fmn_fLw1XZG5U0B8CZMXdsWS_wjBgJ4jaiv_nVF--i_29-YyeQ7BPg6oIPGpEXDEhqxl4ZeeY7quMrMhh2nbupkcHcyB36dCK285D-BLhVtXhed4S1KK-qr6qcOJ76qnDZlDNSx2rIvXwChslXBXFwpPij9JxjKcjv5RWL0qAUXMxKQE8Gf0ZnB_bVZQxRDzw-1CWhKMIyShzahoDJI9dRzKSv-c1xwzz5wTn6FhctGAOk0Sd6KsUIrCBw3W3MXd0uWQXDOhvuYA0aZX9GMRFpOP5penmZNlUaA'
      }]
  },
  srcCorrelationId: 'a5fe8aeb-a0c4-45ce-8313-dde6bb5e6c3d'
}
```

```javascript
/**
 * Launches the Mastercard-hosted Auth UI.
 */
function authenticate (payload) {
  // extract `uri` from methodAttributes - this is the URL to the hosted Auth UI
  const { uri } = payload.authenticationMethod.methodAttributes.uriData

  // load the Auth UI URL with the window origin host defined as a query string parameter
  const launchUri = `${uri}?origin=${window.location.origin}`

  // open a new window with the hosted Auth UI URL following the windowRef object size requirements.
  const windowRef = window.open(launchUri, 'AuthenticatorWindow', 'width=,height=')

  return new Promise((resolve, reject) => {
    // listen to postMessage events coming from the Auth UI window
    window.addEventListener('message', ({ data, source, origin }) => {
      if (source !== windowRef) return // ensure it is the correct window

      switch (data.action) {
        case AuthenticateAction.Ready:
          // Auth UI has loaded and is ready to receive the initial payload
          windowRef.postMessage({
            action: AuthenticateAction.Authenticate,
            payload
          }, origin)
          break
        case AuthenticateAction.Success:
          // Auth UI has completed with success
          windowRef.close()
          return resolve(data.payload)
        case AuthenticateAction.Error:
          // Auth UI has failed to perform authentication
          windowRef.close()
          return reject(data.payload)
      }
    })
  })
}
```

## Perform Authentication {#perform-authentication}

Request transaction authentication while adding a card or performing checkout.

* [Option 1](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/integrate_apis_scof/step5/index.md#option-1-perform-authentication-using-passkey): Perform Authentication using Passkey
* [Option 2](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/integrate_apis_scof/step5/index.md#option-2-perform-authentication-using-a-preferred-method): Perform Authentication using a Preferred Method

## Option 1: Perform Authentication using Passkey {#option-1-perform-authentication-using-passkey}

Mastercard allows the cardholders to create a passkey and the Integrators to use these passkeys for authenticating a transaction.

1. Launch the Mastercard [Authentication UI](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/integrate_apis_scof/step4/index.md) to perform Identity and Verification (ID\&V).   
   The authentication request must comprise of:

* `authenticationMethodType` = MANAGED_AUTHENTICATION
* `authenticationReasons` = ENROL_FINANCIAL_INSTRUMENT or CONSUMER_IDENTITY_VALIDATION or TRANSACTION_AUTHENTICATION
* `transactionAmount` \> 0 and other required parameters
* Mandatory data fields: **acquirerMerchantId** /**acquirerId** , **acquirerBIN** , **merchantCategoryCode** , **dpaLocale** , and **merchantCountryCode**

Note: The `transactionAmount` is required for `authenticationReasons` = TRANSACTION_AUTHENTICATION.

2. If a passkey is not present, Mastercard initiates 3DS authentication.   
   Once the ID\&V is successful, the cardholder is prompted to create a passkey.

3. If a passkey exists, Integrator prompts the cardholder for authentication.

4. Mastercard authenticates the transaction using the passkey and shares the results in `authenticationResult`= AUTHENTICATED and `authenticationStatus`= COMPLETE within `assuranceData` with the Integrator, detailed out [here](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/integrate_apis_scof/step5/index.md).

5. Pass these authentication results in the [Checkout API](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/integrate_apis_scof/step7/index.md) call.

Use cases are available [here](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/token-authentication/secure-card-on-file/by-mastercard/authentication-with-passkey/create-passkey/index.md).

## Option 2: Perform Authentication using a Preferred Method {#option-2-perform-authentication-using-a-preferred-method}

To perform authentication using Issuer supported methods (3DS), follow these steps:

1. Launch the Mastercard [Authentication UI](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/integrate_apis_scof/step4/index.md) to perform 3DS transaction authentication.   
   The authentication request must comprise of:

* `authenticationMethodType` = 3DS
* `authenticationReasons` = TRANSACTION_AUTHENTICATION
* `transactionAmount` \> 0 and other required parameters
* Mandatory data fields: **acquirerMerchantId** , **acquirerBIN** , **merchantCategoryCode** , and **merchantCountryCode**

2. The Issuer may present the challenge on the Authentication UI or a frictionless 3DS transaction authentication is done.

3. The Issuer shares the authentication results with Mastercard.

4. Upon successful 3DS transaction authentication, Mastercard shares the results in `authenticationResult`= AUTHENTICATED and `authenticationStatus`= COMPLETE within `assuranceData` with the Integrator, detailed out [here](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/integrate_apis_scof/step5/index.md).

5. Pass these authentication results in the [Checkout API](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/integrate_apis_scof/step7/index.md) call.

Use case is available [here](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/token-authentication/secure-card-on-file/by-mastercard/authentication-with-3ds/index.md).

## Perform Authentication {#perform-authentication}

Integrators can also opt for Mastercard-approved, third-party authentication solution. In this solution, an Authenticating Entity (AE) serves as a third-party entity and performs authentication.

For more details, refer to the [Authentication by Third Party](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/token-authentication/secure-card-on-file/by-third-party/index.md) use cases.