IT lexicon › Security › 3DS Server

3DS Server

Security På svenska → Updated: 2026-10-30

The merchant-side component of EMV 3-D Secure: it gathers data about the purchase and kicks off authentication.

EMV 3DS has three server roles. The issuer runs the Access Control Server, the card network runs the Directory Server, and the merchant side has the 3DS Server. It takes input from the checkout page or from an SDK inside an app, builds an authentication request (AReq) carrying around a hundred fields about the device, the addresses and the shopper's history, and sends it to the network's DS. The response (ARes) says whether the purchase went through frictionlessly or the cardholder gets a challenge.

In 3DS 1.0 the equivalent was the Merchant Plug-In, or MPI, which did little more than ask whether the card was enrolled. Hardly any merchant runs their own 3DS Server. It has to be approved by EMVCo and assessed under PCI 3DS, so nearly everyone leaves it to their gateway and only notices it when conversion drops.

← Back to the lexicon