Readiness check

Your current version does not support the new authentication flow. Move to a supported version below, then test the flow.

Find the install and upgrade steps for your system in the plugin documentation.

Shopware 5, Drupal, Ecwid, Gambio, Modified eCommerce, nopCommerce, Opencart, osCommerce and Sylius will not support the new authentication flow.

You have two ways forward:

• Move to a shop system with a supported Unzer plugin. See the plugin documentation.
• Integrate against the Unzer API directly and handle the redirect and status flow yourself.

You need to support a redirect step and a status check, the same way you already do for 3-D Secure on cards.

1. Send a returnUrl in your authorize request. This is where Unzer sends the customer once verification is complete.

{
  "returnUrl": "https://www.your-shop.com/checkout/redirect"
}

2. Handle a pending response. When the risk engine requires verification, the authorize response includes isPending: true and a redirectUrl.

{
  "isSuccess": false,
  "isPending": true,
  "isError": false,
  "redirectUrl": "https://sandbox.unzer.com/verify?paymentId=s-pay-124"
}

3. Redirect the customer to redirectUrl. Unzer hosts and displays the verification screen, whichever method the risk engine picked. There is no method-specific UI for you to build.

4. Confirm the final result. After the customer returns to your returnUrl, call GET /v1/payments/{paymentId}. Instead of polling you can subscribe to webhook notifications and be told directly when the final status is available.

Full reference: Accept Unzer Invoice, server-side-only integration.

You need to send a response URL and handle the redirect Unzer returns.

1. Send your response URL in the original PREAUTH request.

<Request version="1.0">
  <Transaction>
    <Frontend>
      <ResponseUrl>https://myshop.de/response.php</ResponseUrl>
    </Frontend>
  </Transaction>
</Request>

On the POST interface, use FRONTEND.RESPONSE_URL=https://myshop.de/response.php.

2. Redirect the customer when you receive a PENDING response.

<Response>
  <Transaction>
    <Processing result="PENDING" code="..." />
    <Redirect url="http://paylater-mfa.test.unzer.io/..."/>
  </Transaction>
</Response>

On the POST interface, the redirect target arrives in PROCESSING.REDIRECT_URL.

3. Query the final status. This check always uses the XML interface, even if you authorise over POST.

• Test: POST https://test-gateway.payolution.com/ctpe/query
• Production: POST https://gateway.payolution.com/ctpe/query

Full reference: Payolution API documentation.

Unzer is introducing UnzerOne Instore, a new in-store BNPL experience with the additional verification step built in from the start.

There is nothing for you to do right now. Unzer will reach out by 20 August to offer the new product. Once you are on UnzerOne Instore you are CCD2 ready.

These steps are the same whether you integrate via PAPI, the Payolution API, or a supported plugin.

Turn on test risk checks first. Unlike production, the test environment does not run real risk checks by default, so the verification step will not trigger on its own. Contact Unzer via the test-channel mailbox to have your channel activated. The test data below only works once that is done. Tell Unzer again when you have finished so the test risk checks can be switched off.

You only need to test the SMS one-time code flow. If your integration handles that redirect and status check correctly, the other methods behave the same way on Unzer’s side.

Cover three scenarios:

• Accepted. Use the test email with the test phone number and code below. The transaction should complete.
• Declined. Use the test email with any other phone number and the same code. The transaction should come back declined.
• Abandoned. Start verification, then either leave without finishing or navigate back. If the customer abandons it, the transaction should reach a final state within 20 minutes and you get a webhook notification. If they navigate back, the order should be cancelled immediately on both sides.

Full test data: test data reference.

Go-live can happen at any point from now on, and all channels are monitored afterwards. Where you stand depends on your integration.

If you run a PAPI server-side-only integration or the Payolution PayOn Wrapper, request activation once your testing is done.

Once Unzer activates your channel, the additional verification step goes live under monitoring. If your integration does not handle it correctly, Unzer support will contact you.

Questions about anything here? Contact support@unzer.com.