Integrate CardEase browser authentication
Follow the separate CardEase 3DS server lifecycle, callbacks and result retrieval.
Provision the CardEase integration
CardEase uses its own boarded merchant identity and C3DS-Merchant-Token header. A public Checkout key or gateway REST credential is not a substitute. The version 1.0.6 guide specifies test https://test3ds2s.cardeasexml.com:9603 and production https://3ds2s.cardeasexml.com:9603. Send JSON requests from your server; an invalid token can return an HTML 401 response.
Check enrollment and initialize
POST /api/v2/auth/enrol checks enrollment and supported protocol versions. Then POST /api/v2/auth/brw/init with merchantId, eventCallbackUrl, a unique threeDSRequestorTransID and acctNumber or the CardEase cardGuid/cardHash pair. Keep the returned authUrl, monUrl and threeDSServerCallbackUrl attached to that transaction.
Collect browser information
Load the returned browser callback and monitoring URLs in their documented iframes. The monitoring window includes ten seconds for the 3DS method and five seconds for browser collection. Authenticate by POSTing to the returned authUrl; carry the callback browserInfo unchanged alongside the required authentication, merchant and cardholder fields. The linked specification defines the complete Authenticate model. Open full CardEase model specification
Handle callback events
Callbacks POST requestorTransId, event and param. Correlate the requestor transaction with your stored session. The PDF introductory sentence says four events, but its event list contains five; handle the five named events. Event Next action 3DSMethodFinished Authenticate using browserInfo in param. 3DSMethodSkipped Authenticate using browserInfo in param. InitAuthTimedOut Source recommends proceeding to authentication using supplied browserInfo. 3DSMethodHasError Log the error; param is an error message, not browserInfo. AuthResultReady Retrieve the final authentication result.
Challenge and retrieve the result
A transStatus of C supplies a challengeUrl for the challenge iframe. After AuthResultReady, GET /api/v2/auth/brw/result using the threeDSServerTransID query parameter. The guide also recommends result retrieval for frictionless flows. Pass the applicable authentication value, ECI and directory-server transaction identity into the downstream payment integration. Authentication success does not establish payment approval.
Choose the protocol version
Version 2.2-only enum values can fail when the issuer supports 2.1. Determine issuer support from enrollment and follow the version-specific field definitions. This guide covers orchestration; the linked 77-page specification remains authoritative for full field lengths, conditional requirements and error codes. Merchant provisioning and issuer challenge execution require an enabled CardEase environment.