3DS GateEMVCo 3-D Secure 2 · Production
The authentication layer between the card and the approval.
3DS Gate serves the cardholder challenge for online merchants that have to authenticate a payment before it reaches authorisation. One host, EMVCo message version 2.1 and 2.2, documented API, and a challenge that renders inside the purchase flow instead of sending the buyer to an issuer portal that may not even exist for that issuer.
Talk to sales Read the docs Open a live challenge
The live sample opens on acs.3dsgate.com — the same host used in production. No signup, no install.
What the product does
Merchants taking card-not-present payments get an authentication step that returns a signed transStatus to the order and keeps the buyer on screen. The service absorbs the tedious half: EMVCo message handling, the threeDSMethodData step, challenge delivery over the mode the issuer actually supports, retry and timeout policy, and an audit trail per session.
Nine delivery modes
SMS, email, push, in-app code, QR, biometric, security question, out-of-band approval and passthrough. Selected per issuer, not per merchant.
EMVCo message shape
creq and cres base64url, threeDSMethodData, acsTransID, dsTransID, messageVersion and the full result object.
Session audit
Every challenge keeps an immutable timeline: render, mode, attempts, result, timing. Exportable for chargeback defence.
Why merchants move to it
Redirect to an issuer portal
The buyer leaves the store, lands on a page under another brand, and often meets an issuer whose 3DS portal is broken or absent. Abandonment happens on the hop, not on the challenge.
Challenge on one known host
The challenge opens on the configured host with the issuer identity, amount and masked card already in place. The buyer stays in the flow and the order returns with a result.
Built to be verified
Most authentication screens can only be judged on sight. 3DS Gate is built so a buyer, an auditor or a fraud analyst can check it with public tooling.
- Fixed host,
acs.3dsgate.com, never randomised per transaction. - DNSSEC enabled, CAA pinned, transfer lock on the zone.
- SPF, DKIM and DMARC at enforcement, plus MTA-STS and TLS-RPT.
- HSTS with
includeSubDomainsand preload, two-year max-age. security.txt, disclosure policy and a named data protection officer.- Company identity with a registry number that resolves in the national register.
Documentation, not a PDF
Integration is one server-side call and one redirect. The docs cover request and response objects, the method step, the challenge lifecycle, error codes and a sandbox with deterministic outcomes.
Quickstart
First authenticated order in about ten minutes, sandbox to result.
API reference
Endpoints, fields, enums, status codes and signature verification.
Commercials
Per authenticated transaction, no monthly floor, no per-seat licence. The sandbox is free and unlimited. Volume tiers start at 50k authentications per month.