Testing

Before going live, run both challenge flows end to end against a test environment. Cake provides its base URL and a separate ProcessorId, IssuerId, and HMAC key during onboarding — never reuse production credentials here.

Test the OTP flow

1. Start a payment on a test card from a range you authenticate, for an amount that triggers a challenge.
2. Your /step_up is called. Return Status: "SUCCESS" with StepupType: "OTP".
3. Your /initiate_action is called with a VerificationToken. Deliver that exact value.
4. Enter the delivered code in the challenge window.

What to check: the code you delivered is accepted. If it is rejected, the usual cause is that your platform generated its own code instead of passing VerificationToken through.

Test the out-of-band flow

1. Start a payment the same way.
2. Return Status: "SUCCESS" with StepupType: "OUTOFBAND" from /step_up.
3. Your /initiate_action is called with an OOBCallbackUrl. Send your push notification.
4. Approve in the app, then post a signed callback to that URL.

What to check: the waiting page resolves without the cardholder clicking Continue. If it only resolves on the click, your callback did not arrive — check the response code you got back.

Test the fallback

Repeat the out-of-band flow but skip the callback entirely. Click Continue on the waiting page instead.

What to check: /validate is called, and returning RETRY keeps the page waiting while returning SUCCESS completes the authentication. This path is what runs whenever your push is delayed, so it is worth exercising deliberately rather than discovering in production.

Test the failure paths

These decide real money, so verify them rather than assuming:

Scenario	How to trigger	Expected
Cardholder refuses	Return REJECTED from /validate	Authentication declined
Your platform is down	Return ERROR from /step_up	Authentication fails — not approved
Endpoint times out	Delay past the request timeout	Same as ERROR
Wrong signature	Send a callback signed with the wrong key	401, and the result is not recorded
Unknown session	Send a callback with a random StepupRequestId	404

TIP

The timeout case is the one most often skipped and most often wrong in production. A slow dependency inside your /step_up handler fails authentications just as surely as an outage, because the ACS cannot wait — test it with a deliberate delay.

Verifying your signature offline

If callbacks are coming back 401, check the signature in isolation before debugging the network path — see the worked example in Security. The two usual causes are using the hex key as raw characters instead of decoding it, and re-serialising the body after signing it.