Cake ACS
Cake builds and operates its own EMV® 3-D Secure Access Control Server (ACS) in-house. When a cardholder pays online with a Cake-issued card, the card network's Directory Server routes the authentication request to this ACS, which decides whether to approve the transaction outright or challenge the cardholder first.
Scope
Visa is the supported card network today. Challenges are OTP and out-of-band; passkey authentication is on the roadmap.
This documentation is for issuers and card processors who integrate their authentication platform with the Cake ACS. If you are a merchant accepting payments and want to know how a challenge behaves in your checkout, see Bahn Gateway → 3DS Authentication instead.
Where the ACS sits
The ACS never talks to the merchant directly. It sits between the card network and your authentication platform:
sequenceDiagram
participant M as Merchant
participant DS as Directory Server
participant ACS as Cake ACS
participant You as Your platform
M->>DS: Authentication request
DS->>ACS: AReq
ACS->>You: POST /step_up
You-->>ACS: Available challenge method
ACS-->>DS: ARes — approve, or challenge
DS-->>M: Result
What you build
The integration is bidirectional, and the direction is the opposite of a typical REST API: for three of the four endpoints, the Cake ACS is the client and your platform is the server.
| Direction | Endpoint | Purpose |
|---|---|---|
| Cake ACS → you | POST /step_up | Open an authentication session and return the method to use |
| Cake ACS → you | POST /initiate_action | Deliver the credential to the cardholder |
| Cake ACS → you | POST /validate | Poll for an out-of-band result |
| You → Cake ACS | OOB callback | Push an out-of-band result as soon as it happens |
Only the OOB callback is optional. Without it the flow still completes, because the ACS falls back to polling /validate — the cardholder simply waits one beat longer.
Protocol
The contract is a small JSON-over-HTTPS API. If your platform already implements this style of step-up integration with another ACS, the three inbound endpoints need no changes; the OOB callback is the only new piece.
Next steps
- Getting started — what to exchange before you write code
- Authentication flows — how frictionless, OTP, and out-of-band differ
- Endpoints you implement — the request and response contract