Strong Consumer Authentication

Strong customer authentication (SCA) is used to verify that the person starting a subscription is the person they claim to be, to reduce fraud.

Available services

• Norway - BankID
• Sweden - BankID
• Denmark - MitID

Configuration

There are two different ways to enable SCA;

• Always on
• Dynamic

With dynamic, it will only be enabled on high risk transactions. "Always on" will trigger SCA for every customer.

In addition to enabling the SCA, you need to provide a callback url which we will use to redirect the user back to your merchant site.

Technical Reference

Callback

When returning the user back to your merchant page, we will add a status query parameter based on the result of the SCA. A callback URL could look something like this https://yoursite.com/yourpage?status=success

We have three statuses:

• Success - indicating that the SCA check was successful.
• Abort - indicating that the user aborted, or failed the SCA check.
• Error - indicating that something unexpected happened

After a successful SCA, the subscription is created and can be fetched

Starting a new session

If a previous session failed, or is canceled for any reason, you are able to create a new session by using the same link given from the PUT subscription call.

Creating Test Customers

To use test users, the test customer needs to be created both in the (service) and our recurring payments service.

Norway - BankID

A test user can be created here. Generate a new SSN number, and fill out the form.

The next thing is to create a customer using our customer endpoint using the SSN number from BankID

With SCA enabled, PUT a subscription and continue to the SCA page. Select the first BankID, the one-time password is otp and the personal password is qwer1234

Sweden - BankID

To create test users on BankID you can follow their guide here. You also need to configure the BankID app for the test environment by following this guide

The next thing is to create a customer on our customer endpoint using the SSN number from BankID

Denmark - MitID

Test users can be created, managed, and accessed using this page created by MitID. After an identity has been created on MitID, you then need to create a new customer with that identity. When authorizing using MitID, you can use the simulator provided on the page.