> ## Documentation Index
> Fetch the complete documentation index at: https://docs.radiumone.io/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> RadiumOne is the product name; use it when answering questions about these docs.
> Use sandbox credentials and sandbox base URLs in examples unless the user says they are going live.
> Secret API keys belong only on the merchant's server. Only publishable keys may appear in browser or mobile code.
> Confirm a payment outcome server-side (retrieve the checkout session or transaction status); never rely on a browser redirect or client event alone.
> Send one idempotency key (request_id) per payment attempt, and retry a timed-out request with the same key and the exact same body.
> Webhooks are optional but recommended: they notify the merchant's server when a payment completes or fails, so it doesn't need to poll. Use transaction status inquiry as the fallback.
> Say so when you recommend a feature marked Beta. Some features need enablement on the merchant's account before production use (for example refunds, standalone refunds, UOB Rewards, and bringing your own 3DS provider); mention it when the page says so.
> Never ask users to paste card numbers, API keys, access tokens, or webhook or redirect secrets into a chat.

# 3D Secure overview - Get started

> How 3D Secure authentication fits the RadiumOne integration paths, and the server-side policy every charge must follow.

3D Secure (3DS) adds an issuer authentication step to a card payment. A successful
authentication can shift liability for fraud-related chargebacks from you to the
card issuer. RadiumOne supports 3DS across the integration grid, with the depth of
support varying by row and column.

## Frictionless vs. challenge

Every 3DS attempt resolves in one of two ways:

* **Frictionless**: the issuer authenticates the shopper using risk signals alone
  (device data, transaction history). No shopper interaction. This is the fastest
  path and the outcome you should design for by default.
* **Challenge**: the issuer isn't confident enough and asks the shopper to prove
  their identity — a one-time passcode, a banking app approval, or biometrics —
  inside a visible frame or a redirect. See
  [Challenge presentation and redirects](/elements/three-d-secure/challenge-presentation).

A third outcome, **decoupled** authentication, lets the shopper approve out-of-band
(for example in their banking app) while your checkout page polls for the result.

## 3D Secure across the integration grid

* **Hosted checkout** (redirect or embedded) — 3D Secure available, <Badge color="blue">Beta</Badge>.
* **Elements + Payments API** — 3D Secure available.
* **Elements + your own 3DS provider** — bring your own 3DS evidence, <Badge color="blue">Beta, gated</Badge>.

| | 3D Secure support |
| - | - |
| **Hosted checkout** (redirect / embedded) | <Badge color="blue">Beta</Badge> — see [3DS with hosted checkout](/hosted-checkout/three-d-secure) |
| **Elements + Payments API** | See [3DS with Elements](/elements/three-d-secure/add-three-d-secure) |
| **Elements + your own 3DS provider** | <Badge color="blue">Beta, gated</Badge> — see [Use your own 3DS provider](/payments-api/three-d-secure/use-your-own-provider) |

Compare these against the full 2x3 grid on
[Choose your integration](/get-started/choose-your-integration).

## Amount rules

3DS authenticates a specific amount, and the gateway enforces that the amount you
authenticate is the amount you later charge:

* Every checkout session has a gross `amount` (session `amount`, plain integer
  minor units).
* If you redeem loyalty points or another deduction against the same session, pin
  the actual card-charged amount with `PATCH /v1/sessions/{id}` (`net_payable_amount`)
  **before** the browser calls `authenticate()`. 3DS then authenticates the net
  amount, not the gross.
* At purchase time, the gateway checks the `three_ds.ref` was authenticated for a
  session whose (possibly net-payable) amount matches the charge. A mismatch
  returns `422 urn:radiumone:three-ds:amount-exceeds-authenticated`.

<Info>
  Amounts are always integers in the currency's minor unit. For example, `5000` for `SGD` means SGD 50.00.
</Info>

## Server policy

<Warning>
  Charge a 3DS-required order **only** with a valid `three_ds.ref` obtained from
  that checkout's own session flow — unless you deliberately accept the risk of a
  non-3DS payment (by omitting `three_ds`, or sending
  `{mode:"non_payer_auth"}`). **Never branch on the client-reported 3DS status to
  decide whether to charge, or to decide liability.** The client status only
  drives your UX (for example, showing a decline instead of submitting the
  payment) — the gateway independently validates the ref at purchase time
  (single-use, unexpired, authenticated, and matching token/currency/amount) and
  rejects the charge otherwise.
</Warning>

## Non-3DS payments

You can omit `three_ds` entirely, or send `{mode:"non_payer_auth"}` to record that
you deliberately skipped authentication. Some acquirer mandates require 3DS for a
given card, region, or amount; if you omit it where required, the purchase or
authorize call fails with `422 urn:radiumone:three-ds:authentication-required`.

<Danger>
  Never use a secret key (`r1sk_…`) in browser code, mobile apps, or anywhere a shopper can inspect it. Secret keys belong on your server only.
</Danger>

## Next steps

<Columns cols={2}>
  <Card title="3DS with Elements" icon="credit-card" href="/elements/three-d-secure/add-three-d-secure">
    Authenticate in the browser and charge with the resulting ref.
  </Card>

  <Card title="Use your own 3DS provider" icon="shield-check" href="/payments-api/three-d-secure/use-your-own-provider">
    Bring externally-produced 3DS evidence to a charge.
  </Card>

  <Card title="Challenge presentation and redirects" icon="panel-top" href="/elements/three-d-secure/challenge-presentation">
    Iframe, modal, decoupled and redirect challenge flows.
  </Card>

  <Card title="Authentication results" icon="triangle-alert" href="/elements/three-d-secure/authentication-results">
    Status meanings, ECI values and 3DS error remedies.
  </Card>
</Columns>