Controlling 3DS

By default Bahn decides for itself whether a card payment needs 3D Secure authentication. The request_three_d_secure option lets you override that decision and skip 3DS entirely.

Skipping 3DS is a risk transfer, not an optimisation: you trade the friction of a challenge for the liability of a fraud chargeback. For that reason the option is not available by default — see Restrictions below.

INFO

This page covers the server-side decision of whether 3DS runs. For handling a challenge once it is triggered — mounting the modal, callbacks, error codes — see 3DS Authentication.

Restrictions

Two things reject a request that asks for never. In both cases the create or confirm call fails and no payment is attempted — never is never silently downgraded to automatic.

Your account must be enabled for it

request_three_d_secure: never is enabled per merchant account and is off by default. Contact Bahn (your account manager) to have it enabled before you integrate against it.

Sending never from an account that is not enabled for it rejects the request. Do not ship code that sends never on the assumption it will be ignored. Until Bahn confirms your account is enabled, omit the field.

It cannot be combined with saving the card

Authentication is mandatory when a card is being saved for future off-session use. A request that asks to both skip 3DS and save the card is rejected — the save-card rule wins, and never does not override it.

If you need to save a card, use automatic (or omit the field). See Save Card & Recurring.

automatic is the default for every account, needs no enablement, and is subject to neither restriction.

The Options

Set the option under payment_method_options.card:

Value	Behaviour
automatic	Default, and what applies when the field is omitted. Bahn's 3DS rules decide, based on the card, the amount, and the payment's risk signals. Some payments are challenged, some are not.
never	Skip 3DS for this payment, overriding Bahn's rules. Subject to the restrictions below — it is not available to every account, and cannot be combined with saving the card.

What never costs you

• No liability shift. A 3DS-authenticated payment moves fraud-chargeback liability to the issuer. Without it, a fraud chargeback stays with you.
• It does not make payments succeed. Skipping authentication does not stop an issuer from declining the authorization on its own risk assessment.

What it does not affect

Device network tokens are unaffected either way. Apple Pay and Google Pay DPANs carry their own cardholder authentication from the device, so request_three_d_secure changes nothing for them — with or without it, the wallet's own assurance applies. See Apple Pay.

Setting the Option

payment_method_options is accepted on both create and confirm. Set it on whichever call attempts the payment.

On create, when you confirm in the same call:

POST /api/payment_intents

{
  "amount": 100000,
  "currency": "704",
  "confirm": true,
  "payment_method_id": "pm_01HZ3XA2K4T7QJ0M9C5N8E1D3F",
  "payment_method_options": {
    "card": {
      "request_three_d_secure": "never"
    }
  }
}

On confirm, for a PaymentIntent you created earlier:

POST /api/payment_intents/{id}/confirm

{
  "payment_method_id": "pm_01HZ3XA2K4T7QJ0M9C5N8E1D3F",
  "payment_method_options": {
    "card": {
      "request_three_d_secure": "never"
    }
  }
}

Field	Required	Description
payment_method_options.card.request_three_d_secure	No	automatic (default) or never. never requires the option to be enabled on your merchant account.

Confirming the Outcome

The value you send is a request, and automatic makes no promise either way — so never assume from the request alone whether a challenge happened. Read the confirm response:

• 3DS was triggered — the PaymentIntent comes back requires_action with a next_action of type use_sdk (three_d_secure_2), which the SDK turns into a challenge. See 3DS Authentication.
• 3DS was not triggered — the PaymentIntent goes straight to succeeded, processing, or requires_capture.

With never accepted on an enabled account, you should never see the 3DS next_action. If you do, your account is not applying the option — check with Bahn rather than working around it in your integration.

Choosing a Value

Situation	Use
Anything you are unsure about	automatic
Saving a card for future off-session charges	automatic — never is rejected in this flow
A low-value, low-risk payment where Bahn has agreed you carry the fraud liability	never, once enabled

Leaving the field out is always safe, and is the right default for a new integration.