# Standalone (Sessions)

The Standalone (Sessions) API enables you to authenticate online transactions with the EMV [3D Secure (3DS)](https://www.checkout.com/docs/payments/authenticate-payments/3d-secure.md) protocol.
You can use it to implement enhanced 3DS authentication flows. This API also:

- Gives you greater visibility of issuer authentication decisions
- Provides a smoother experience for your customers, while helping you meet [Strong Customer Authentication (SCA)](https://www.checkout.com/docs/business-operations/ensure-regulatory-compliance/sca-compliance.md) requirements

---

## How it works

After authenticating using the Standalone (Sessions) API, you can authorize the payment using one of the following:

 - Checkout.com's payment gateway
 - Another payment services provider (PSP)
 - The [ID from the Standalone (Sessions) API response](https://www.checkout.com/docs/payments/authenticate-payments.md#Standalone_sessions_authentication)

You can integrate with Standalone (Sessions) in the following ways:

- Hosted – Checkout.com hosts and manages the 3DS flow front end.
- Non-hosted – You own and manage the 3DS flow front end.

Standalone (Sessions) supports:

- Identity Check by Mastercard
- Fast’R by Cartes Bancaires
- J/Secure by JCB
- ProtectBuy by Discover/Diners Club International (DCI)
- SafeKey by American Express
- Visa Secure by Visa

---

## Acquirer BINs

When you onboard with Checkout.com to process authentications, you can choose to use:

- Your acquirer's bank identification numbers (BINs) – The scheme charges a 3DS fee to your acquirer, who may pass this on to you.
- Checkout.com's acquirer BINs – We charge you the 3DS fee, which is reflected in your [Balance Report](https://www.checkout.com/docs/funds-management/retrieve-financial-reports/balance-reports/balance-report.md) and [Payouts Report](https://www.checkout.com/docs/funds-management/retrieve-financial-reports/settlement-reports/payouts-report.md) as the _Authentication Scheme Fee_.

> **Information**
>
> You can use our acquirer BINs even if you plan to process the authenticated payments with another PSP.

---

## Non-hosted

Non-hosted sessions give you full control over your authentication journey.

1. Initiate authentication using the Standalone (Sessions) API, and provide the following:
    - Card or a network token
    - `"completion.type":"non-hosted"`
    - Optionally, `completion.callback_url` to receive the authentication result
2. Collect channel (either browser or mobile app) and additional authentication data.
3. Perform a challenge (if required).
4. Handle the authentication result.
5. Authorize the payment, either through our payment gateway or another PSP.

[Get started with non-hosted sessions](https://www.checkout.com/docs/risk-management/3d-secure/sessions/non-hosted-sessions.md)

---

## Hosted

Checkout.com manages the authentication journey for you.

1. Initiate authentication through the Standalone (Sessions) API, and provide the following:
    - `"completion.type":"hosted"`
    - `completion.success_url`
    - `completion.failure_url`
2. Redirect the customer to the URL returned in the response.
3. Checkout.com collects the necessary payment, device, and cardholder data, performs any challenge required, handles the result, and authorizes the payment.

[Get started with hosted sessions](https://www.checkout.com/docs/risk-management/3d-secure/sessions/hosted-sessions.md)

---

## Authorization

When you create a session, authorize your request with access key authorization.

Call the [Request an access token](https://api-reference.checkout.com/tag/Access/#operation/requestAnAccessToken) endpoint to generate an `access_token`, and use it to authorize your create session request.

> **Information**
>
> Your base URL's `{prefix}` value is unique to your account and environment. To learn how to retrieve your base URLs for the sandbox and production environments, see [API endpoints](https://www.checkout.com/docs/developer-resources/api/api-endpoints.md).

**Production**

`POST` `https://{prefix}.access.checkout.com/connect/token`

**Sandbox**

`POST` `https://{prefix}.access.sandbox.checkout.com/connect/token`

### Request example

**Payload**

```bash
grant_type=client_credentials&client_id= ack_3kgxgdj773yubf4sfmiht3r4h4
&client_secret=PddTMk1FBjk1MDQHtBt1U8cHjZvS+Guc80NmcUHp3pHevOpt7EgYkT/DWae7gnOTlF6kPCPo+RZEu9xut/5VVA==
```

**cURL**

```bash
curl --location --request POST 'https://{prefix}.access.sandbox.checkout.com/connect/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id=ack_3kgxgdj773yubf4sfmiht3r4h4' \
--data-urlencode 'client_secret=PddTMk1FBjk1MDQHtBt1U8cHjZvS+Guc80NmcUHp3pHevOpt7EgYkT/DWae7gnOTlF6kPCPo+RZEu9xut/5VWA=='
```

### Response example

The token server returns a Bearer `access_token` in JSON Web Token (JWT) format.

The token is valid for the length of time (in seconds) specified in the `expires_in` field. When it expires, you must request a new one.

```json
{
  "access_token": "eyJhb6sqaQ",
  "expires_in": 3600,
  "token_type": "Bearer",
  "scope": "flow fx gateway"
}
```
---

## Related topics

- [Non-hosted sessions](https://www.checkout.com/docs/payments/authenticate-payments/3d-secure/standalone-sessions/non-hosted-sessions.md): The Non-hosted sessions solution gives you full control over your 3D Secure authentication flow.
- [Hosted sessions](https://www.checkout.com/docs/payments/authenticate-payments/3d-secure/standalone-sessions/hosted-sessions.md): Learn about our hosted sessions solution, where we manage the authentication flow for you.
- [3DS Exemptions](https://www.checkout.com/docs/payments/authenticate-payments/3d-secure/standalone-sessions/3ds-exemptions.md): Learn how to provide a frictionless authentication experience with 3DS exemptions.
- [Smart optimization of authentication requests](https://www.checkout.com/docs/payments/authenticate-payments/3d-secure/standalone-sessions/smart-optimization-of-authentication-requests.md): Learn how to optimize your authentication requests, using our intelligent acceptance engine.