Payment Authorisation (for Merchants)

The Payment Authorisation (for Merchants) extension enables a merchant or a Payment Initiation Service Provider (PISP) to authorise a payment using an SCA Attestation presented from the customer's EUDI Wallet. This is the third-party-requested flow defined in the TS12 Electronic Payments SCA Implementation with Wallet specification.

How it works

1. The organisation enables the Payment Authorisation (for Merchants) extension from the dashboard.
2. An administrator configures the merchant/PISP identity shown in the authorisation request and the transaction fields bound to authentication (dynamic linking).
3. When a customer checks out at the merchant or via a PISP, a presentation request with an urn:eudi:sca:payment:1 transaction data payload is triggered using the configured presentation definition.
4. The customer reviews the payment details in their EUDI Wallet and presents the SCA Attestation previously issued by their ASPSP.
5. The system verifies the presentation, validates the Key Binding JWT and forwards the PSD2 Authentication Code to the ASPSP to complete the payment.

Configuration

Supported SCA Attestation types

Select which SCA Attestation the merchant or PISP accepts for this flow. Only the account and card attestations are supported:

Payment Account Credential

Attribute	Description
iban	International Bank Account Number
bic	Bank Identifier Code
currency	Account currency

Payment Card Credential

Attribute	Description
pan_last_four	Last four digits of the card's Primary Account Number
scheme	Card scheme (e.g. Visa, Mastercard)
scheme_logo	Logo of the card scheme

Transaction data

The verification request carries an urn:eudi:sca:payment:1 transaction data object. The fields below are cryptographically bound to the authentication (dynamic linking):

Field	Type	Description
transaction_id	String	Unique identifier for the payment transaction
date_time	DateTime	Timestamp of the payment request
payee	Object	Recipient of the payment
├─ name	String	Name of the recipient
├─ id	String	Identifier of the recipient
├─ logo	String	Logo of the recipient
└─ website	String	Website of the recipient
pisp	Object	Payment Initiation Service Provider
├─ legal_name	String	Legal name of the PISP
├─ brand_name	String	Brand name of the PISP
└─ domain_name	String	Domain of the PISP
execution_date	DateTime	Requested execution date
currency	String	ISO 4217 currency code
amount	Number	Transaction amount
amount_estimated	Boolean	True if the amount is an estimate
amount_earmarked	Boolean	True if funds are earmarked
sct_inst	Boolean	True if SEPA Instant Credit Transfer
recurrence	Object (optional)	Recurring payment schedule
├─ start_date	DateTime	First date the recurrence is valid
├─ end_date	DateTime	Last date the recurrence is valid
├─ number	Number	Number of occurrences
└─ frequency	String	Frequency of the recurrence
mit_options	Object (optional)	Merchant-Initiated Transaction parameters
├─ amount_variable	Boolean	True if the charged amount can vary between occurrences
├─ min_amount	Number	Minimum amount per charge
├─ max_amount	Number	Maximum amount per charge
├─ total_amount	Number	Total amount across all charges
├─ initial_amount	Number	Amount of the first charge
├─ initial_amount_number	Number	Number of initial charges at initial_amount
└─ apr	Number	Annual percentage rate

Accepted issuers

Select which ASPSPs (issuers) are trusted to issue the SCA Attestation for this flow. Only attestations signed by the selected issuers are accepted.

Integration

Once configured, the system automatically generates a Presentation Definition bound to the urn:eudi:sca:payment:1 transaction data type. This presentation definition can be viewed from the extension configuration page and is used when initiating payment authorisation requests via the API.

API endpoints:

• GET/v3/config/extension/payment-authorisation-merchant - Retrieve current configuration
• PUT/v3/config/extension/payment-authorisation-merchant - Update payment authorisation settings

Caution: Disabling the Payment Authorisation (for Merchants) extension deletes its configuration. This action is not reversible.