---
title: 3DSecure Flow
slug: extensions/kwbn7C-eukm9XgVsOF8Ew
docTags: 
createdAt: 2025-12-14T14:23:41.918Z
---

# 3DSecure in the Forter SFCC Cartridge

The Forter SFCC cartridge can provide 3DS recommendations and exemptions in the pre-authorization server response body for merchants to initiate 3DS challenges to customers.

Additionally, customizations in the cartridge code (specifically `int_forter_sfra/forterOrder.ds`) allow merchants to populate the post-authorization call to Forter so that it includes 3DS response fields such as eciValue, cavvValue, and threeDSServerTransID.

## Flow

**Pre- & Post-Auth Decisions**

![](https://api.archbee.com/api/optimize/dYhsqkppjaUNAqFmds_Ny-KtpKzaKUcoN890sSjSL1q-20250724-184327.png)

**Pre-Auth Decision and Post-Auth Order Status**

![](https://api.archbee.com/api/optimize/dYhsqkppjaUNAqFmds_Ny-8SejwXCjs346Ppo0ihYFK-20250724-184340.png)

The high-level flow within your SFCC platform and the Forter cartridge would be architected in the following way:

## Customer initiates a transaction

Customer checks out on site, provides payment information and submits order.

## Pre-Auth Call to Forter

A synchronous Pre-authorization **Validation call** is made in the Forter Cartridge that includes some payment data such as card token, name on Card, brand and Forter returns a response that includes a decision AND a recommendation field with an indicator for 3DS

```javascript
{
  "message": "",
  "action": "decline"
  "recommendations": ["VERIFICATION_REQUIRED_3DS_CHALLENGE"],
  "reasonCode": "",
  "transaction": "123abcde",
  "status": "success"
}
```

## Call to Payment Gateway and initate 3DS\*\*

Merchant makes a call to their payment gateway cartridge that includes the Forter recommendation so that the relevant 3DS recommendation can be leveraged. Note that handling the Forter recommendation and integrating this response to the payment gateway must be done by the merchant development team and will vary depending on the gateway cartridge and 3DS configuration used by the merchant.

## Post-Auth Call to Forter

A second call is made to Forter that includes the authorization and 3DS response from your payment gateway. The second call to Forter can be either:

### Post-Auth Validation

A second, synchronous **Validation call** that includes the gateway authorization response data including processor response information and 3DS response. Forter's cartridge will return a final synchronous binary approve/decline decision based on the additional gateway data.

\[3DS Pre-Auth & Post-Auth]\(./3DS Integration Guide.md)

### Post-Auth Order Status

An **Order Status** that includes the gateway authorization and 3DS response and a status of either *"PROCESSING"* (if the gateway authorized the transaction) or *"CANCELED\_BY\_MERCHANT"* (if the transaction was not authorized). In this case, the status is received but no new decision is rendered.

\[3DS Post-Auth]\(./3DS Integration Guide.md)