Data-only flow
Learn how to use data-only flow to facilitate a more secure and efficient authentication process.
What is data-only?
Data-only leverages the 3D Secure 2 infrastructure to share payer data with the card network, without requiring direct interaction from the payer.
The key difference from a regular 3D Secure 2.0 flow is that the issuer doesn’t verify the payer upfront. Instead, Visa or Mastercard receives the payer data, performs risk analysis, and handles issuer-side authentication.
How it works
Once a data-only request is made, dLocal sends it to the relevant card scheme.
- When a data-only request is initiated, dLocal forwards the transaction data to the corresponding card network.
- The card network evaluates the transaction and collaborates with the issuer to perform a risk-based authentication assessment.
- The resulting risk evaluation data is included in the authorization message, allowing the issuer to use it as part of their approval decision process.
How card networks handle data-only flows
| Card network | Description |
|---|---|
| Mastercard Data-Only | Mastercard supports data-only transactions through its risk evaluation services. When payer data is sent, Mastercard analyzes the transaction and communicates with the issuer to support authentication behind the scenes. The risk outcome is included in the authorization, helping improve approval decisions without requiring payer interaction. |
| Visa: Data-Only Flow for Authentication (DFA) | Visa handles data-only flows under its DFA model. The transaction data is sent directly to Visa, which performs a real-time risk assessment. This information is passed to the issuer during the authorization step, enabling smarter decisions without triggering a challenge for the payer. |
Benefits of using data-only
- Improve user experience. By eliminating additional authentication steps, the data-only flow enables faster and smoother transactions, reducing friction and minimizing potential cart abandonment.
- Enhance data insights. Sending additional risk and transaction information to Visa, Mastercard, and the issuing bank allows for more comprehensive datasets. This supports better fraud detection and can lead to higher approval rates for future transactions.
- Simplified integration. If your system already supports 3DS 2.0, integrating data-only is straightforward, as the data fields are mapped similarly. This allows merchants to implement the flow without major technical changes.
Data-only params integration
To ensure an optimal 3DS data-only assessment, it is strongly recommended to share the following parameters:
| Property | Type | Description |
|---|---|---|
payer | Payer object | Cardholder additional Information |
additional_risk_data.shipping.address | Shipping address object | Information on the shipping/alternative address. Add this to your request if it applies. |
Note
The data-only flow will still be performed even if some of these fields are not provided.
However, providing more detailed information allows the card networks and issuers to perform a more accurate risk evaluation, potentially improving approval rates and reducing fraud.
Example request with recommended parameters for data-only
Visa
curl -X POST \
-H 'X-Date: 2018-02-20T15:44:42.310Z' \
-H 'X-Login: {X-Login}' \
-H 'X-Trans-Key: {X-Trans-Key}' \
-H 'Content-Type: application/json' \
-H 'X-Version: 2.1' \
-H 'User-Agent: MerchantTest / 1.0' \
-H 'Authorization: V2-HMAC-SHA256, Signature: 1bd227f9d892a7f4581b998c21e353b1686a6bdad5940e7bb6aa596c96e0a1aa' \
-d '{body}'
https://api.dlocal.com/secure_payments
{
"amount": 120.00,
"currency": "BRL",
"country": "BR",
"payment_method_id": "CARD",
"payment_method_flow": "DIRECT",
"payer":{
"name": "Thiago Gabriel", // Data-only param
"email": "[email protected]", // Data-only param
"document": "53033315550",
"user_reference": "12345",
"phone": "123456712345", // Data-only param
"address": {
"state": "Rio de Janeiro", // Data-only param
"city": "Volta Redonda", // Data-only param
"zip_code": "27275-595", // Data-only param
"street": "Servidao B-1", // Data-only param
"number": "1106" // Data-only param
},
"ip": "179.27.83.210", // Data-onlyy param
"device_id": "2fg3d4gf234" // Data-only param
},
"card":{
"holder_name": "Thiago Gabriel",
"number": "4111111111111111",
"cvv": "123",
"expiration_month": 10,
"expiration_year": 2040,
"capture": false
},
"order_id": "657434343",
"notification_url": "http://merchantsite.com/notifications",
"additional_risk_data": {
"shipping": {
"address": {
"state": "Montevideo", // Data-only param
"city": "Montevideo", // Data-only param
"zip_code": "11300", // Data-only param
"street": "Avda. Brasil", // Data-only param
"number": "1234 Ap. 501" // Data-only param
},
}
}
{
"id": "D-4-cf8eef6b-52d5-4320-b5ea-f5e0bbe4343f",
"amount": 120,
"currency": "BRL",
"payment_method_id": "CARD",
"payment_method_type": "CARD",
"payment_method_flow": "DIRECT",
"country": "BR",
"card": {
"holder_name": "Thiago Gabriel",
"expiration_month": 10,
"expiration_year": 2040,
"brand": "VI",
"last4": "1111"
},
"three_dsecure": {
"eci": "07"
},
"created_date": "2018-12-26T20:26:09.000+0000",
"approved_date": "2018-12-26T20:26:09.000+0000",
"status": "AUTHORIZED",
"status_detail": "The payment was authorized",
"status_code": "600",
"order_id": "657434343",
"notification_url": "http://merchantsite.com/notifications"
}
Mastercard
curl -X POST \
-H 'X-Date: 2018-02-20T15:44:42.310Z' \
-H 'X-Login: {X-Login}' \
-H 'X-Trans-Key: {X-Trans-Key}' \
-H 'Content-Type: application/json' \
-H 'X-Version: 2.1' \
-H 'User-Agent: MerchantTest / 1.0' \
-H 'Authorization: V2-HMAC-SHA256, Signature: 1bd227f9d892a7f4581b998c21e353b1686a6bdad5940e7bb6aa596c96e0a1aa' \
-d '{body}'
https://api.dlocal.com/secure_payments
{
"amount": 120.00,
"currency": "BRL",
"country": "BR",
"payment_method_id": "CARD",
"payment_method_flow": "DIRECT",
"payer":{
"name": "Thiago Gabriel", // Data-only param
"email": "[email protected]", // Data-only param
"document": "53033315550",
"user_reference": "12345",
"phone": "123456712345", // Data-only param
"address": {
"state": "Rio de Janeiro", // Data-only param
"city": "Volta Redonda", // Data-only param
"zip_code": "27275-595", // Data-only param
"street": "Servidao B-1", // Data-only param
"number": "1106" // Data-only param
},
"ip": "179.27.83.210", // Data-onlyy param
"device_id": "2fg3d4gf234" // Data-only param
},
"card":{
"holder_name": "Thiago Gabriel",
"number": "5555555555554444",
"cvv": "123",
"expiration_month": 10,
"expiration_year": 2040,
"capture": false
},
"order_id": "657434343",
"notification_url": "http://merchantsite.com/notifications",
"additional_risk_data": {
"shipping": {
"address": {
"state": "Montevideo", // Data-only param
"city": "Montevideo", // Data-only param
"zip_code": "11300", // Data-only param
"street": "Avda. Brasil", // Data-only param
"number": "1234 Ap. 501" // Data-only param
},
}
}
{
"id": "D-4-cf8eef6b-52d5-4320-b5ea-f5e0bbe4343f",
"amount": 120,
"currency": "BRL",
"payment_method_id": "CARD",
"payment_method_type": "CARD",
"payment_method_flow": "DIRECT",
"country": "BR",
"card": {
"holder_name": "Thiago Gabriel",
"expiration_month": 10,
"expiration_year": 2040,
"brand": "MC",
"last4": "4444"
},
"three_dsecure": {
"eci": "04"
},
"created_date": "2018-12-26T20:26:09.000+0000",
"approved_date": "2018-12-26T20:26:09.000+0000",
"status": "AUTHORIZED",
"status_detail": "The payment was authorized",
"status_code": "600",
"order_id": "657434343",
"notification_url": "http://merchantsite.com/notifications"
}
Updated about 10 hours ago