---
title: "Authenticate Payer"
method: POST
path: "/v6/direct/authenticate/payer"
---

# Authenticate Payer

`POST /v6/direct/authenticate/payer`

## Request body

- object
  - `sessionId` string, required — A session ID, is a unique identifier that a server generates as part of the create session API call and assigns to a merchant transaction for the duration of the session (15 min).
  - `orderId` string, required — This is a unique identifier for this order to discern it from others order you created. If orderId is not sent with the request, an orderId is created by the server and returned in the response. The orderid can be used to refer to this order in subsequent transactions and in retrieving meta data about the order. The orderId must always be unique for every order created under your merchant profile. This must be a valid GUID.
  - `source` 'HPP' | 'MobileApp' | 'DirectAPI' — Source of capturing the transaction. Use "DirectAPI" for this call.
  - `paymentMethod` object, required — Details of the card used for the purchase.
    - `cardholderName` string, required — Name on card
    - `cardNumber` string, required — Valid card number, as a string without any separators.
    - `cvv` string, required — Card Verification Value. This code is usually composed of a three-digit number provided available at the back of the card or 4 digit number above the card number on the right side on the front of the card
    - `expiryDate` object — Expiry month and year of the card
      - `month` string, required — 2 digit number for the month
      - `year` string, required — 2-digit year code
  - `deviceIdentification` object, required — Unique device identifier
    - `providerDeviceId` string — Unique identifier of the customer device used for the payment.
    - `language` 'en' | 'ar' — The language settings of the device or browser. ISO 639-1 code must be used
    - `userAgent` string — The User-Agent is a characteristic string that lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent.
  - `timeZone` string — Time in minutes from UTC timezone.

## Response `200`

200

- object
  - `orderId` string
  - `threeDSecureId` string
  - `htmlBodyContent` string
  - `gatewayDecision` string
  - `responseMessage` string
  - `detailedResponseMessage` string
  - `language` string
  - `responseCode` string
  - `detailedResponseCode` string

## Other responses

- `400` — 400

---

[API](https://skmtc.dev/geidea/apis/checkout-v2.md) · [All operations](https://skmtc.dev/geidea/apis/checkout-v2/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/geidea/checkout-v2/revisions/873e534eeb01/schema)