---
title: "Data-only flow"
description: "Implement 3D Secure 2 to only share data with Visa or Mastercard instead of sending an authentication request."
url: "https://docs.adyen.com/online-payments/3d-secure/data-only"
source_url: "https://docs.adyen.com/online-payments/3d-secure/data-only.md"
canonical: "https://docs.adyen.com/online-payments/3d-secure/data-only"
last_modified: "2023-02-13T00:12:00+01:00"
language: "en"
---

# Data-only flow

Implement 3D Secure 2 to only share data with Visa or Mastercard instead of sending an authentication request.

[View source](/online-payments/3d-secure/data-only.md)

In a regular 3D Secure 2 flow, the payment has to be authenticated by the issuer before it can be authorized. In a data-only flow, you use the same 3D Secure 2 infrastructure, but only to share shopper data with Visa or Mastercard directly. The card schemes then handle the risk evaluation and the authentication with the issuer. The data-only flow is particularly useful outside [PSD2 SCA](/online-payments/psd2-sca-compliance-and-implementation-guide) regulated markets.

## Requirements

| Requirement          | Description                                                                                                                                                                                                                                                                                                                                                                              |
| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Integration type** | A [3D Secure 2 integration](/online-payments/3d-secure/) for Web, Android or iOS. We recommend a [native 3D Secure 2 integration](/online-payments/3d-secure/native-3ds2).                                                                                                                                                                                                               |
| **Limitations**      | The data-only flow is available for Visa and Mastercard outside [PSD2 SCA](/online-payments/psd2-sca-compliance-and-implementation-guide) regulated markets. [DCAP](#dcap) applies only to merchants in the United States and Canada.                                                                                                                                                    |
| **Setup steps**      | To use the [Authentication Engine](#authentication-engine) for the data-only flow, make sure that you:- Have set up a 3D Secure 2 [native](/online-payments/3d-secure/native-3ds2/) (recommended) or [redirect](/online-payments/3d-secure/redirect-3ds2/) integration.
- Set the default [dynamic 3D Secure rule](/risk-management/dynamic-3d-secure/#default-rules) to **Prefer not**. |

## How it works

When you send a data-only request, Adyen sends it directly to Visa or Mastercard. The card schemes then handle the authentication request with the issuer, and include their risk evaluation in the authorization message. The issuer uses the risk evaluation data to improve their decision when authorizing a payment.

Because this flow only shares data, shoppers will **not** be presented with a 3D Secure 2 challenge. This also means that there is no liability shift for the data-only flow.

## Use the Authentication Engine

We recommend using our [Authentication Engine](https://www.adyen.com/knowledge-hub/psd2-simplified-with-our-new-authentication-engine) to make optimal use of the data-only flow, including Visa's [Digital Commerce Authentication Program](#dcap). The Authentication Engine is included when you set up your native or redirect [3D Secure 2 integration](/online-payments/3d-secure/) with Adyen. Based on issuer readiness and performance uplift, the engine can make the best decision on when to use the data-only flow.

## Make a data-only payment request

When you use the native or redirect 3D Secure 2 integration for Web, iOS or Android, the [Authentication Engine](#authentication-engine) will decide if the data-only flow is triggered. No further action is required on your side.

To optimize the engine and to help the card schemes and the issuers make better risk assessments, collect and submit as many of the following recommended fields as possible in your payment request:

* [shopperIP](https://docs.adyen.com/api-explorer/Checkout/latest/post/payments#request-shopperIP)
* [paymentMethod.holderName](https://docs.adyen.com/api-explorer/Checkout/latest/post/payments#request-paymentMethod-CardDetails-holderName)
* [shopperEmail](https://docs.adyen.com/api-explorer/Checkout/latest/post/payments#request-shopperEmail)
* [billingAddress](https://docs.adyen.com/api-explorer/Checkout/latest/post/payments#request-billingAddress)
* [deliveryAddress](https://docs.adyen.com/api-explorer/Checkout/latest/post/payments#request-deliveryAddress) (if available)
* `threeDS2requestData.homePhone`, `threeDS2requestData.mobilePhone` or `threeDS2requestData.workPhone`

The [3D Secure 2 API reference](/online-payments/3d-secure/api-reference/#3d-secure-2-additional-data-objects) has more information about these fields.

If you are processing Visa transactions in the United States or Canada, make sure that you review the [DCAP](#dcap) section below.

If you want to force the data-only flow, or if you have built an [API-only integration](/online-payments/3d-secure/native-3ds2#api-only) that uses our 3D Secure 2 component, make a POST [/payments](https://docs.adyen.com/api-explorer/Checkout/latest/post/payments) request containing the 3D Secure 2 fields and the following:

* `additionalData.threeDS2DataOnly`: **true**. This forces the 3D Secure 2 data-only flow for all transactions where this flow is possible.

* For a better shopper experience, we recommend using specific 3D Secure 2 values. Depending on your integration:

  * Checkout API v68 or earlier: include `allow3DS2`: **true**.
  * Checkout API v69 or later: include `nativeThreeDS`: **preferred**.

**Example data-only payment request**

```curl
curl https://checkout-test.adyen.com/v72/payments \
-H 'X-API-key: ADYEN_API_KEY' \
-H 'content-type: application/json' \
-d '{
        "amount":{
            "currency":"EUR",
            "value":1000
        },
        "reference":"YOUR_ORDER_NUMBER",
        "paymentMethod":{
            "type":"scheme",
            "number": "5201281822783116",
            "expiryMonth": "03",
            "expiryYear": "2030",
            "cvc": "737",
            "holderName": "S. Hopper"
        },
        "authenticationData": {
            "threeDSRequestData": {
   	              "nativeThreeDS": "preferred"
            }
        },
        "additionalData" : {
            "threeDS2DataOnly": true
        },
        "browserInfo":{
            "userAgent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/70.0.3538.110 Safari\/537.36",
            "acceptHeader":"text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng,*\/*;q=0.8",
            "language":"nl-NL",
            "colorDepth":24,
            "screenHeight":723,
            "screenWidth":1536,
            "timeZoneOffset":0,
            "javaEnabled": true
        },
        "channel": "web",
        "origin" : "https://your-company.example.com/",
        "returnUrl" : "https://your-company.example.com/checkout/",
        "merchantAccount":"YOUR_MERCHANT_ACCOUNT"
    }'
```

Check the `resultCode` included in the [/payments](https://docs.adyen.com/api-explorer/Checkout/latest/post/payments) response. If the `resultCode` is **Authorised**, inform the shopper that the payment was successful.

**Example data-only payment response**

```json
{
"pspReference": "V4HZ4RBFJGXXGN82",
"resultCode": "Authorised"
}
```

## Visa's Digital Commerce Authentication Program (DCAP)

**Eligibility**\
DCAP currently only applies to merchants in the United States. The program expands to Canadian merchants in October 2026.

DCAP applies to customer-initiated, Card Not Present transactions. Cost-saving incentives do not apply to [merchant-initiated transactions](/get-started-with-adyen/adyen-glossary#contauth-continuous-authorization) or [in-person payments](/get-started-with-adyen/adyen-glossary#point-of-sale) transactions.

DCAP is a Visa program that aims to enhance the security and authorization rates of [Card Not Present](/get-started-with-adyen/adyen-glossary#card-not-present-cnp) transactions by using the 3D Secure data-only flow to share more data with issuers. Visa offers interchange fee discounts for this data.

We recommend that you use Adyen's [Authentication Engine](https://www.adyen.com/knowledge-hub/psd2-simplified-with-our-new-authentication-engine) to optimize your interchange discounts with DCAP. We do not recommend that you apply the data-only flow for all transactions, as this can lower your authorization rates with some issuers.

Visa requires you send **all** the following fields to qualify for DCAP interchange discounts:

* [shopperIP](https://docs.adyen.com/api-explorer/Checkout/latest/post/payments#request-shopperIP)
* [shopperEmail](https://docs.adyen.com/api-explorer/Checkout/latest/post/payments#request-shopperEmail)
* [billingAddress](https://docs.adyen.com/api-explorer/Checkout/latest/post/payments#request-billingAddress): Include all billing address fields.
* [deviceFingerprint](https://docs.adyen.com/api-explorer/Checkout/latest/post/payments#request-deviceFingerprint): Send a device fingerprint to identify the shopper's device.

Do not send empty or placeholder data with any of the above fields. If you fail to submit all fields, you will lose your interchange discount. If you repeatedly send incomplete data, Visa could remove you from DCAP.

## Test the data-only flow

Use the test card below to try the 3D Secure 2 data-only flow. Testing is only available for Mastercard.

| Card Type  | Card Number         | Expiry Date | CVC/CVV |
| ---------- | ------------------- | ----------- | ------- |
| Mastercard | 5201 2818 2278 3116 | 03/2030     | 737     |

## See also

* [3D Secure 2 authentication integration guide](/online-payments/3d-secure/)
* [PSD2 SCA compliance guide](/online-payments/psd2-sca-compliance-and-implementation-guide/)
* [Dynamic 3D Secure](/risk-management/dynamic-3d-secure/)
