> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gr4vy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# 3-D Secure testing

## Testing approaches

There are two approaches to testing 3D Secure:

1. **Test cards from 3DS provider** (documented below): Use specific card numbers provided by the underlying 3DS providers to simulate different authentication outcomes directly in your payment flows.
2. **Register custom scenarios**: Programmatically create and manage authentication scenarios via the [3DS Scenarios API](/guides/features/3ds/scenarios). This approach provides more flexible testing and configuration, but is only available for the hosted 3DS flow.

<Info>
  This guide covers testing for **Embed**, **Hosted**, and **External** 3DS approaches only.

  If you're building a **Native 3DS** integration with Secure Fields, iOS (Swift), or Android (Kotlin), refer to the dedicated testing sections in those guides:

  * [Secure Fields Native 3DS testing](/guides/payments/secure-fields/three-d-secure#testing-and-validation)
  * [Native SDK testing](/guides/payments/native/3ds#testing-and-validation)
</Info>

## Configuration

Before testing 3DS in the sandbox environment, ensure:

* 3DS is configured for each card scheme (Visa, Mastercard, American Express, etc.) on your primary card connector
* Flow rules do not skip 3DS for the test scenarios you want to verify
* You're using the correct test card numbers for your desired outcome

## Testing with hosted embed and web flows

The Gr4vy 3DS integration uses 3DSecure.io as the 3DS provider. Use the following test cards to simulate different authentication scenarios.

### Frictionless authentication - successful

These cards return a frictionless response with successful authentication (`transStatus: Y`).

| Card Number        | Scheme           | Expiry | Security Code | Outcome              |
| ------------------ | ---------------- | ------ | ------------- | -------------------- |
| `5200000000001203` | Mastercard       | 03/30  | 100           | Frictionless success |
| `4111111111101203` | Visa             | 03/30  | 100           | Frictionless success |
| `340000000022003`  | American Express | 03/30  | 1000          | Frictionless success |
| `3558111111121203` | JCB              | 03/30  | 100           | Frictionless success |

### Challenge flow - manual and automatic

These cards trigger a challenge that requires user interaction.

| Card Number        | Scheme           | Expiry | Security Code | Outcome            |
| ------------------ | ---------------- | ------ | ------------- | ------------------ |
| `5240000000001072` | Mastercard       | 03/30  | 100           | Challenge required |
| `4111111111181072` | Visa             | 03/30  | 100           | Challenge required |
| `340000000082072`  | American Express | 03/30  | 1000          | Challenge required |
| `3558111111121872` | JCB              | 03/30  | 100           | Challenge required |

When a challenge is triggered, complete the verification process in the challenge modal. The outcome depends on your selection:

* **Manual challenge (card ending in 72)**: You can choose to pass or fail the challenge.
* **Automatic challenge (card ending in 70)**: The challenge automatically passes.

### Card not enrolled

Cards without 3DS enrollment skip authentication.

| Card Number        | Scheme | Expiry | Security Code | Outcome      |
| ------------------ | ------ | ------ | ------------- | ------------ |
| `9000100111111111` | Visa   | 03/30  | 100           | Not enrolled |

### Advanced testing scenarios

For more detailed testing including message version variations and 3DS method handling, refer to the [3DSecure.io sandbox documentation](https://docs.3dsecure.io/3dsv2/sandbox.html).

The following test card patterns can be used for specific scenarios:

* **Message version testing**: Cards with patterns like `xxxx` in positions 2-4 determine the 3DS message version (2.1, 2.2, or 2.3.1).
* **3DS Method**: Cards with `x0xx` pattern include 3DS Method, `x1xx` exclude it, `x2xx` simulate timeout.
* **Challenge outcomes**: Cards with `xx70` auto-pass, `xx71` auto-fail, `xx72` allow manual selection.