Scheme passkeys
Scheme passkeys let cardholders verify online payments with the same biometric they use to unlock their device, as an alternative to a one-time password or 3D Secure (3DS) challenge.
Cardholders complete biometric authentication with a passkey during a 3DS transaction. For example, the cardholder can approve the payment with their fingerprint instead of retrieving a one-time password externally. The biometric data never leaves the cardholder's device, and Checkout.com never receives or stores biometric data.
Scheme passkeys are available on devices and browsers that support passkeys. They run over your existing 3DS integration, so no separate authentication API is required.
After a passkey is created, it's bound to the cardholder's device and reused on future payments, with no re-enrollment.
With scheme passkeys, you benefit by:
- Increasing your authentication success rate.
- Giving your cardholders a faster, phishing-resistant biometric experience.
- Reducing abandonment, so fewer customers drop off during authentication.
- Retaining the same issuer liability shift as a standard 3DS transaction.
Note
Scheme passkey authentication is currently available for Visa cards only, for eligible traffic on participating issuers, and in browser-based payments only.
To enable scheme passkey authentication, contact your account manager or request support.
To set up scheme passkeys, you must:
- Configure the iframe permissions.
- Request the passkey experience.
The passkey prompt uses WebAuthn, the browser standard for passkeys, and runs inside a cross-origin iframe. Under EMV 3DS guidance, WebAuthn fails in a cross-origin iframe unless the embedding iframe delegates the required permissions through its allow attribute.
If you embed our hosted authentication page in an iframe, add the following permissions so the passkey prompt can reach the challenge iframe:
If you authenticate payments using our integrated authentication solution, you can use the authentication.preferred_experiences field to tell us which authentication experiences to attempt, and in what order.
The preferred_experiences field is optional, and we recommend omitting it. If you omit it, we select the authentication experience for each session on your behalf, so you benefit from our optimization without changing your integration.
To request a scheme passkey explicitly, list passkey as the first value in the array. For example:
The array is an ordered preference list. We try the first experience that applies and move down the list if it's unavailable. The following table shows how different values behave:
| Preferred experience | Result |
|---|---|
Omitted | Recommended. We select the best authentication experience for each payment. |
| Attempts a scheme passkey, then falls back to standard 3DS automatically. |
| Same as |
| Not recommended. A scheme passkey is never attempted, as the payment prefers standard 3DS. |
If a passkey is unavailable for the card, or the cardholder does not complete it, the payment automatically continues as a standard 3DS authentication.
For this fallback to work, provide 3DS authentication data in all of your payment requests.