---
title: "Create a PaymentIntent"
method: POST
path: "/v2/payment_intents/create"
tags: ["Payment Intents"]
---

# Create a PaymentIntent

`POST /v2/payment_intents/create`

Creates a new payment intent to process a payment.
After the PaymentIntent is created, attach a payment method and `confirm` API to continue the payment.

## Headers

- `x-on-behalf-of` string
- `x-idempotency-key` string, uuid
- `x-client-id` string, required

## Request body

- PaymentIntentCreateRequest
  - `amount` string, required
  - `currency` string, required — Three-letter currency code
  - `payment_method` union — The payment method details to confirm the PaymentIntent. The PaymentIntent will be confirmed automatically when `payment_method` is set.
    - object
      - `type` 'card', required
      - `card` object, required
        - `card_name` string, required — Card holder name. Maximum length is 128.
        - `card_number` string, required — Card number.
        - `expiry_month` string, required — Two digit number representing the card's expiration month.
        - `expiry_year` string, required — Four digit number representing the card's expiration year.
        - `cvc` string, required — The CVC code of this card is mandatory for all transactions, except for those initiated by the merchant or involving network tokenization.
        - `network` 'visa' | 'mastercard' | 'unionpay', required — The card network. The card networks listed are accepted values for this field. Availability is evaluated at the account level.
        - `billing` CardBilling, required — Billing information of the customer.
          - `first_name` string, required — First name of the customer. Maximum length is 128.
          - `last_name` string, required — Last name of the customer. Maximum length is 128.
          - `email` string, email, required — Email address of the customer.
          - `phone_number` string — Phone number of the customer.
          - `address` Address, required
            - `country_code` string, required — The two-letter country code in ISO 3166-1 alpha-2 format.
            - `state` string — State or province of the address. Maximum of 100 characters. - Required when `country_code` is "US" or "CA".
            - `city` string, required — City of the address. Maximum of 100 characters.
            - `street` string, required — Street of the address. Maximum of 100 characters.
            - `postcode` string, required — Postcode of the address. Maximum of 10 characters.
        - `auto_capture` boolean — Specifies whether the funds should be requested automatically after the payment is authorized. Set it to `false` if you want to capture the funds sometimes later.
        - `authorization_type` 'authorization' | 'pre_authorization', required — The authorization type for the card payment. Options are `authorization` (default) and `pre_authorization`. Use `pre_authorization` to hold funds for more than 7 days, available only for Visa and Mastercard. `auto_capture` must be `false` for pre-authorization.
        - `three_ds_action` 'enforce_3ds' | 'skip_3ds', required — Controls 3D Secure behavior for this payment: - `enforce_3ds`: Always trigger 3DS authentication, regardless of issuer risk assessment. - `skip_3ds`: Skip 3DS authentication. The liability for chargebacks remains with the merchant.
        - `three_ds` CardThreeDS
          - `return_url` string — Return URL for 3ds callbacks (in case 3ds is triggered).
          - `acs_response` string — 3DS ACS response (application/x-www-form-urlencoded).
          - `device_data_collection_res` string — Device data collection response.
          - `ds_transaction_id` string — 3DS transactionId.
    - object
      - `type` 'card_present', required
      - `card_present` object, required
        - `card_number` string, required — Card number.
        - `expiry_month` string, required — MM
        - `expiry_year` string, required — YYYY
        - `cardholder_verification_method` 'online_pin' | 'manual_signature' | 'skipped' — Method used to verify the cardholder's identity at the point of sale. - `online_pin`: Cardholder entered a PIN that was verified online by the issuer. - `manual_signature`: Cardholder provided a handwritten signature. - `skipped`: Cardholder verification was not performed (e.g., contactless under floor limit).
        - `encrypted_pin` string — Encrypted personal identification number.
        - `pan_entry_mode` 'manual_entry' | 'chip' | 'magstripe' | 'contactless_chip' | 'contactless_magstripe', required — The way the terminal reads the card information: - `manual_entry`: Manually keyed into POS terminal - `chip`: Read from direct contact with a chip card - `magstripe`: Read from direct contact with magnetic stripe card - `contactless_chip`: Read from a contactless interface using chip data - `contactless_magstripe`: Read from a contactless interface using magnetic stripe data (MSD)
        - `fallback` boolean — The default is false. Set to true when: - Chip card at a chip-capable terminal was unable to process transactions using data on the chip or magnetic strip and use entry mode manual - Chip card at a chip-capable terminal was unable to process transactions using data on the chip and use entry mode `contact_magnetic_stripe_card`
        - `fallback_reason` 'chip_read_failure' — Fallback reason applicable when fallback is true. Set to `chip_read_failure` when all of the following conditions are met: - The transaction is initiated at a chip-capable terminal - `pan_entry_mode` is `magstripe` - The previous transaction initiated by the terminal was an unsuccessful chip read
        - `emv_tags` string — Tag-length-value (TLV)-encoded data read from a chip card.
        - `track1` string — Track 1 read from magnetic stripe card
        - `track2` string — Track 2 is read from a magnetic stripe card or is track 2 equivalent data get from the chip card. Track 2 is required when pan_entry_mode is not `manual_entry`.
        - `terminal_info` object
          - `terminal_id` string — An up to 8 digit alphanumeric ID used to identify the terminal at the card acceptor location of the user's POS system.
          - `mobile_device` boolean — Indicate whether the POS terminal is a mobile POS device.
          - `system_trace_audit_number` string — System Trace Audit Number. A 6-digit numeric sequence that uniquely identifies each transaction processed by a terminal. Critical for transaction reconciliation and dispute resolution.
          - `use_embedded_reader` boolean — Indicate whether the reader is embedded in a mobile POS device.
    - object
      - `type` 'applepay', required
      - `applepay` object, required — Apple Pay payment information. Required when `type` is set to `applepay`.
        - `flow` 'redirect' | 'mobile_web' | 'mobile_app' | 'contactless', required — Specifies the checkout flow type: - `redirect`: Redirect-based online payment - `mobile_web`: Mobile browser (H5) payment - `mobile_app`: Native app payment - `contactless`: In-person NFC contactless payment
        - `os_type` 'ios' — Required when `flow` is `mobile_web` or `mobile_app`. Fixed value `ios` for Apple Pay.
        - `is_present` boolean — Whether the customer is physically present during payment. Set to `true` for in-person (contactless) payments, `false` for online payments.
        - `network` 'visa' | 'mastercard' | 'amex' | 'discover' | 'jcb', required — The card network (lowercase).
        - `card_type` 'debit' | 'credit' — The type of the card.
        - `token_type` 'decrypted' | 'encrypted', required — The token data format: - `decrypted`: Merchant has decrypted the Apple Pay token and provides structured DPAN + Cryptogram data - `encrypted`: Raw encrypted Apple Pay token (reserved for future use)
        - `auth_method` 'cryptogram_3ds' | 'pan_only', required — The authentication method used by Apple Pay: - `cryptogram_3ds`: Token includes a cryptogram, 3DS is already applied. No additional 3DS required. - `pan_only`: Token contains only PAN data. Additional 3DS verification may be triggered.
        - `network_token` object, required — The decrypted Network Token data. Required when `token_type` is `decrypted`.
          - `number` string, required — Device Primary Account Number (DPAN), 12-52 characters.
          - `expiry_month` string, required — Two-digit expiration month (01-12).
          - `expiry_year` string, required — Four-digit expiration year.
          - `cryptogram` string, required — Online Payment Cryptogram (Base64 encoded). Only required when `auth_method` is `cryptogram_3ds`.
          - `eci` string — Electronic Commerce Indicator. Only required when `auth_method` is `cryptogram_3ds`. Typical value: `07`.
        - `billing_contact` object — Billing contact information from Apple Pay.
          - `first_name` string — Given name (first name).
          - `last_name` string — Family name (last name).
          - `email` string, email — Email address.
          - `phone` string — Phone number.
          - `address` object — Billing address.
            - `street` string — Street address.
            - `city` string — City.
            - `state` string — State or province.
            - `postal_code` string — Postal code.
            - `country_code` string — Country code (ISO 3166-1 alpha-2).
    - object
      - `type` 'googlepay', required
      - `googlepay` object, required — Google Pay payment information. Required when `type` is set to `googlepay`.
        - `flow` 'redirect' | 'mobile_web' | 'mobile_app' | 'contactless', required — Specifies the checkout flow type: - `redirect`: Redirect-based online payment - `mobile_web`: Mobile browser (H5) payment - `mobile_app`: Native app payment - `contactless`: In-person NFC contactless payment
        - `os_type` 'ios' | 'android' — Required when `flow` is `mobile_web` or `mobile_app`. One of `ios`, `android`.
        - `is_present` boolean — Whether the customer is physically present during payment. Set to `true` for in-person (contactless) payments, `false` for online payments.
        - `network` 'visa' | 'mastercard' | 'amex' | 'discover' | 'jcb', required — The card network (lowercase).
        - `card_type` 'debit' | 'credit' — The type of the card.
        - `token_type` 'decrypted' | 'encrypted', required — The token data format: - `decrypted`: Merchant has decrypted the Google Pay token and provides structured DPAN + Cryptogram data - `encrypted`: Raw encrypted Google Pay token (reserved for future use)
        - `auth_method` 'cryptogram_3ds' | 'pan_only', required — The authentication method used by Google Pay: - `cryptogram_3ds`: Token includes a cryptogram, 3DS is already applied. No additional 3DS required. - `pan_only`: Token contains only PAN data. Additional 3DS verification may be triggered.
        - `network_token` object, required — The decrypted Network Token data. Required when `token_type` is `decrypted`.
          - `number` string, required — Device Primary Account Number (DPAN), 12-52 characters.
          - `expiry_month` string, required — Two-digit expiration month (01-12).
          - `expiry_year` string, required — Four-digit expiration year.
          - `cryptogram` string — Online Payment Cryptogram (Base64 encoded). Only required when `auth_method` is `cryptogram_3ds`.
          - `eci` string — Electronic Commerce Indicator. Only required when `auth_method` is `cryptogram_3ds`. Typical value: `05`.
        - `billing_address` object — Billing address information from Google Pay.
          - `first_name` string — First name.
          - `last_name` string — Last name.
          - `email` string, email — Email address.
          - `phone` string — Phone number.
          - `address1` string — Address line 1.
          - `address2` string — Address line 2.
          - `locality` string — City or locality.
          - `administrative_area` string — State, province, or administrative area.
          - `postal_code` string — Postal code.
          - `country_code` string — Country code (ISO 3166-1 alpha-2).
    - object
      - `type` 'alipaycn', required
      - `alipaycn` object, required — AlipayCN payment information. Required when `type` is set to `alipaycn`
        - `flow` 'qrcode', required — The specific payment flow to use.
        - `os_type` 'ios' | 'android' — Required when flow is `mobile_web` or `mobile_app`. One of `ios`, `android`.
        - `is_present` boolean — Whether the customer is physically present during payment.
        - `payment_code` string — The customer presents a payment code (generated from a payment app like an e-wallet) to the merchant for scanning.
    - object
      - `type` 'alipayhk', required
      - `alipayhk` object, required — AlipayHK payment information. Required when `type` is set to `alipayhk`
        - `flow` 'qrcode', required — The specific payment flow to use.
        - `os_type` 'ios' | 'android' — Required when flow is `mobile_web` or `mobile_app`. One of `ios`, `android`.
        - `payment_code` string — The customer presents a payment code (generated from a payment app like an e-wallet) to the merchant for scanning.
        - `is_present` boolean — Whether the customer is physically present during payment.
    - object
      - `type` 'unionpay', required
      - `unionpay` object, required — UnionPay payment information. Required when `type` is set to `unionpay`
        - `flow` 'qrcode' | 'securepay', required — The UnionPay checkout flow: - `qrcode`: Merchant-presented QR code for the customer to scan with the UnionPay app. - `securepay`: Server-to-server secure payment (redirect-based online checkout).
        - `os_type` 'ios' | 'android' — Required when flow is `mobile_app`. One of `ios`, `android`.
        - `is_present` boolean — Whether the customer is physically present during payment.
        - `payment_code` string — The customer presents a payment code (generated from a payment app like an e-wallet) to the merchant for scanning.
    - object
      - `type` 'wechatpay', required
      - `wechatpay` object, required — WeChat Pay payment information. Required when `type` is set to `wechatpay`.
        - `flow` 'qrcode' | 'mini_program' | 'mobile_app' | 'mobile_web' | 'official_account', required — The WeChat Pay checkout flow: - `qrcode`: Merchant-presented QR code for the customer to scan. - `mini_program`: Payment inside a WeChat Mini Program. - `mobile_app`: Payment triggered from a native mobile app via WeChat SDK. - `mobile_web`: Payment triggered from a mobile browser (H5), redirects to WeChat. - `official_account`: Payment inside a WeChat Official Account (JSAPI).
        - `os_type` 'ios' | 'android' — Required when flow is `mobile_web` or `mobile_app`. One of `ios`, `android`.
        - `payment_code` string — The customer presents a payment code (generated from a payment app like an e-wallet) to the merchant for scanning.
        - `is_present` boolean — Whether the customer is physically present during payment.
        - `open_id` string — Required when `flow` is `mini_program`, `mobile_app` or `official_account`.
    - object
      - `type` 'grabpay', required
      - `grabpay` object, required — GrabPay payment information. Required when `type` is set to `grabpay`.
        - `flow` 'qrcode', required — Specifies the checkout flow type.
        - `os_type` 'ios' | 'android' — Required when flow is `mobile_web`.
        - `is_present` boolean — Whether the customer is physically present during payment.
        - `payment_code` string — The customer presents a payment code (generated from a payment app like an e-wallet) to the merchant for scanning.
        - `shopper_name` string — The name of the shopper.
    - object
      - `type` 'crypto', required
      - `crypto` object, required — Cryptocurrency payment information. Required when `type` is set to `crypto`. **Important:** Currency must be `USD`. **Legal Notice:** This API Reference is issued and published by UQPAY PTY LTD (UQPAY Australia), a member of the UQPAY Group. As the sole publishing entity, UQPAY Australia assumes full and exclusive responsibility for the content, versioning, and maintenance of this document. Unless expressly stated otherwise, no other entity within the UQPAY Group shall be considered a publisher or held liable for the information contained herein.
        - `flow` 'redirect' | 'qrcode', required — The specific payment flow to use: - `redirect`: Redirects customer to a crypto payment gateway - `qrcode`: Generates a QR code for direct blockchain payment
        - `network` 'ETH' | 'TRON' — Blockchain network for the transaction. Required when `flow` is `qrcode`. - `ETH`: Ethereum network - `TRON`: TRON network
        - `is_present` false, required — Whether the customer is physically present during payment. Must be `false` for crypto payments.
        - `payer_info` object — Payer compliance information collected to satisfy the AML/CTF Travel Rule for virtual asset transfers. **Conditional requirement:** Required when the order amount reaches the compliance threshold configured by UQPAY for the merchant; otherwise this object can be omitted entirely.
          - `name` string, required — Full legal name of the payer (individual or entity).
          - `email` string, email — Payer email address. Validated for standard email format when provided.
          - `identifier` object, required — A unique identifier for the payer. Exactly one identifier must be provided, selected via the `type` field. The structure of `value` varies based on `type`.
            - `type` 'document_number' | 'birth_info' | 'address', required — The category of identifier provided: - `document_number`: A government-issued identification document - `birth_info`: Date and place of birth - `address`: Structured residential or business address
            - `value` union, required — The identifier payload. Structure depends on `type`.
              - …
    - object
      - `type` 'paynow', required
      - `paynow` object, required — PayNow payment information. Required when `type` is set to `paynow`.
        - `flow` 'qrcode', required — The checkout flow. Only `qrcode` (merchant-presented QR code) is supported.
        - `is_present` boolean — Whether the customer is physically present during payment.
    - object
      - `type` 'truemoney', required
      - `truemoney` object, required — Truemoney payment information. Required when `type` is set to `truemoney`.
        - `flow` 'qrcode', required — The specific payment flow to use.
        - `os_type` 'ios' | 'android' — Required when flow is `mobile_web` or `mobile_app`. One of `ios`, `android`.
        - `payment_code` string — The customer presents a payment code (generated from a payment app like an e-wallet) to the merchant for scanning.
        - `is_present` boolean — Whether the customer is physically present during payment.
    - object
      - `type` 'tng', required
      - `tng` object, required — Touch'n Go payment information. Required when `type` is set to `tng`.
        - `flow` 'qrcode', required — The specific payment flow to use.
        - `os_type` 'ios' | 'android' — Required when flow is `mobile_web` or `mobile_app`. One of `ios`, `android`.
        - `payment_code` string — The customer presents a payment code (generated from a payment app like an e-wallet) to the merchant for scanning.
        - `is_present` boolean — Whether the customer is physically present during payment.
    - object
      - `type` 'gcash', required
      - `gcash` object, required — GCash payment information. Required when `type` is set to `gcash`.
        - `flow` 'qrcode', required — The specific payment flow to use.
        - `os_type` 'ios' | 'android' — Required when flow is `mobile_web` or `mobile_app`. One of `ios`, `android`.
        - `payment_code` string — The customer presents a payment code (generated from a payment app like an e-wallet) to the merchant for scanning.
        - `is_present` boolean — Whether the customer is physically present during payment.
    - object
      - `type` 'dana', required
      - `dana` object, required — Dana payment information. Required when `type` is set to `dana`.
        - `flow` 'qrcode', required — The specific payment flow to use.
        - `os_type` 'ios' | 'android' — Required when flow is `mobile_web` or `mobile_app`. One of `ios`, `android`.
        - `payment_code` string — The customer presents a payment code (generated from a payment app like an e-wallet) to the merchant for scanning.
        - `is_present` boolean — Whether the customer is physically present during payment.
    - object
      - `type` 'kakaopay', required
      - `kakaopay` object, required — KakaoPay payment information. Required when `type` is set to `kakaopay`.
        - `flow` 'qrcode', required — The specific payment flow to use.
        - `os_type` 'ios' | 'android' — Required when flow is `mobile_web` or `mobile_app`. One of `ios`, `android`.
        - `payment_code` string — The customer presents a payment code (generated from a payment app like an e-wallet) to the merchant for scanning.
        - `is_present` boolean — Whether the customer is physically present during payment.
    - object
      - `type` 'toss', required
      - `toss` object, required — Toss Pay payment information. Required when `type` is set to `toss`.
        - `flow` 'qrcode', required — The specific payment flow to use.
        - `os_type` 'ios' | 'android' — Required when flow is `mobile_web` or `mobile_app`. One of `ios`, `android`.
        - `payment_code` string — The customer presents a payment code (generated from a payment app like an e-wallet) to the merchant for scanning.
        - `is_present` boolean — Whether the customer is physically present during payment.
    - object
      - `type` 'naverpay', required
      - `naverpay` object, required — Naver Pay payment information. Required when `type` is set to `naverpay`.
        - `flow` 'qrcode', required — The specific payment flow to use.
        - `os_type` 'ios' | 'android' — Required when flow is `mobile_web` or `mobile_app`. One of `ios`, `android`.
        - `payment_code` string — The customer presents a payment code (generated from a payment app like an e-wallet) to the merchant for scanning.
        - `is_present` boolean — Whether the customer is physically present during payment.
  - `ip_address` string — IPv4 or IPv6 address of the device. Required when `payment_method.card.three_ds_action=enforce_3ds`. Optional otherwise.
  - `customer` CustomerRequest
    - `business_name` string — Customer's business name
    - `external_customer_id` string — Identifier for the customer in your own system. When supplied through the `customer` object on a PaymentIntent, UQPay uses it to look up an existing customer with the same external identifier before creating a new one.
    - `first_name` string, required — Customer's first name
    - `last_name` string, required — Customer's last name
    - `email` string, email, required — Customer's email address
    - `phone_number` string — Customer's phone number
    - `description` string — An arbitrary string that you can attach to a customer object.
    - `address` Address
      - `country_code` string, required — The two-letter country code in ISO 3166-1 alpha-2 format.
      - `state` string — State or province of the address. Maximum of 100 characters. - Required when `country_code` is "US" or "CA".
      - `city` string, required — City of the address. Maximum of 100 characters.
      - `street` string, required — Street of the address. Maximum of 100 characters.
      - `postcode` string, required — Postcode of the address. Maximum of 10 characters.
    - `metadata` Metadata — Any key-value object. Max length = 512 bytes. This must be valid JSON data.
  - `customer_id` string — ID of an existing UQPay customer returned by a previous Create PaymentIntent call. Pass this on subsequent payments for the same shopper so the hosted payment page can offer their saved cards. When both `customer_id` and `customer` are supplied, `customer_id` takes precedence. Leave empty for guest checkout (the PaymentIntent will not participate in Card on File).
  - `payment_orders` object — Purchase order related to this PaymentIntent
    - `type` string — Industry category of the order. Maximum of 128 characters.
    - `products` object[] — Order-related product information. The total sum of all product amounts must equal the overall payment amount.
      - `name` string, required — Name of the product. Maximum of 255 characters.
      - `price` string, required — The price per quantity of product.
      - `quantity` integer, required — The quantity of the product to be purchased.
      - `image_url` string — The preview image url for this product, which is usually displayed as thumbnail in the order details.
  - `merchant_order_id` string, required — The merchant reference id created in merchant's system that corresponds to this PaymentIntent
  - `description` string, required — Descriptor that will display to the customer. Maximum length is 32.
  - `browser_info` BrowserInfo — Browser information collected for risk and fraud prevention. Required when `three_ds_action=enforce_3ds`
    - `accept_header` string, required — Browser accept header
    - `browser` object, required — Browser specific information
      - `java_enabled` boolean — Whether Java is enabled in browser
      - `javascript_enabled` boolean — Whether JavaScript is enabled in browser
      - `user_agent` string, required — Browser user agent string
    - `device_id` string — Unique device identifier
    - `language` string, required — ISO language code (e.g. EN) or language-region (e.g. en-US)
    - `location` object — Device geolocation if available
      - `lat` string — Latitude coordinate
      - `lon` string — Longitude coordinate
    - `mobile` object — Mobile device–specific information. This object is required when the transaction is initiated from a mobile client. For web-based integrations, this object should be set to null.
      - `device_model` string — Mobile device model name
      - `os_type` 'IOS' | 'ANDROID' — Mobile operating system
      - `os_version` string — Operating system version
    - `screen_color_depth` integer, required — Screen color depth in bits
    - `screen_height` integer, required — Screen height in pixels
    - `screen_width` integer, required — Screen width in pixels
    - `timezone` string — Timezone offset from UTC (e.g. -2 or 8)
  - `metadata` Metadata — Any key-value object. Max length = 512 bytes. This must be valid JSON data.
  - `return_url` string, required — The web page URL or application scheme URI to redirect the customer after payment authentication.

## Response `200`

Payment intent created successfully

- PaymentIntentCreateResponse
  - `payment_intent_id` string, required — Unique identifier for the PaymentIntent
  - `amount` string, required
  - `currency` string, required — Three-letter currency code
  - `description` string — Descriptor while creating a PaymentIntent.
  - `available_payment_method_types` string[], nullable — Available payment method types for this PaymentIntent.
  - `captured_amount` string
  - `customer` CustomerResponse
    - `id` string — Unique customer ID
    - `external_customer_id` string — Identifier for the customer in your own system, echoed back when supplied at creation time.
    - `first_name` string — Customer's first name
    - `last_name` string — Customer's last name
    - `email` string, email — Customer's email address
    - `phone_number` string — Customer's phone number
    - `address` Address
      - `country_code` string, required — The two-letter country code in ISO 3166-1 alpha-2 format.
      - `state` string — State or province of the address. Maximum of 100 characters. - Required when `country_code` is "US" or "CA".
      - `city` string, required — City of the address. Maximum of 100 characters.
      - `street` string, required — Street of the address. Maximum of 100 characters.
      - `postcode` string, required — Postcode of the address. Maximum of 10 characters.
    - `metadata` Metadata — Any key-value object. Max length = 512 bytes. This must be valid JSON data.
    - `create_time` string, date/time
    - `update_time` string, date/time
  - `customer_id` string — ID of the customer associated with this PaymentIntent. Empty for guest checkout.
  - `cancel_time` string, date/time
  - `cancellation_reason` string — Reason for canceling this PaymentIntent.
  - `client_secret` string — PaymentIntent's client secret for browser or app. Returned by PaymentIntent create API or PaymentIntent retrieve API. The provided client_secret is valid for 60 minutes.
  - `merchant_order_id` string — The merchant reference id created in merchant's system that corresponds to this PaymentIntent
  - `metadata` Metadata — Any key-value object. Max length = 512 bytes. This must be valid JSON data.
  - `next_action` NextAction — If present, this property tells you what actions you need to take in order for your customer to fulfill a payment using the provided source.
    - `type` 'redirect_to_url' | 'display_qr_code' | 'display_bank_details' | 'redirect_iframe', required — The type of action required to continue the payment. - `redirect_to_url`: Redirect the customer to a URL for authentication (e.g., 3DS verification or wallet login). - `display_qr_code`: Display a QR code for the customer to scan with their payment app. - `display_bank_details`: Display bank account details for the customer to complete a manual bank transfer. - `redirect_iframe`: Embed the provided iframe HTML into your page to display an inline authentication interface.
    - `redirect_to_url` object — Contains instructions for authenticating a payment by redirecting your customer to another page or application.
      - `url` string, uri — The URL you must redirect your customer to in order to authenticate the payment.
      - `return_url` string, uri — If the customer does not exit their browser while authenticating, they will be redirected to this specified URL after completion.
    - `redirect_iframe` object — Contains instructions for authenticating a payment using an iframe embed method. The client needs to embed the returned iframe script content into their page to complete the payment authentication flow.
      - `iframe` string, html — Complete iframe HTML script content containing the authentication page embed code. The client must directly embed this script into their page to display the authentication interface.
    - `display_qr_code` object — The field that contains QR code info.
      - `qr_code_url` string — The URL to the hosted WeChat Pay instructions page, which allows customers to view the WeChat Pay QR code.
      - `expires_at` string, date-time — The date (unix timestamp) when the QR code expires.
    - `display_bank_details` object — Contains the bank transfer details necessary for the customer to complete the payment.
      - `bank_name` string — The bank name of the account.
      - `account_number` string — The account number.
      - `routing_number` string — The routing number.
  - `return_url` string — The web page URL or application scheme URI to redirect the customer after payment authentication.
  - `create_time` string, date/time
  - `complete_time` string, date/time
  - `update_time` string, date/time
  - `latest_payment_attempt` PaymentAttemptResponse
    - `attempt_id` string, required — Unique identifier for the attempt.
    - `amount` string, required
    - `currency` string, required — Three-letter currency code
    - `captured_amount` string
    - `refunded_amount` string
    - `create_time` string, date/time
    - `update_time` string, date/time
    - `complete_time` string, date/time
    - `cancellation_reason` string — Reason for canceling this PaymentIntent.
    - `auth_code` string — Authorization code returned by the issuer upon successful authorization.
    - `arn` string — Acquirer Reference Number (ARN). A 23-digit identifier used for cross-institution reconciliation and chargeback tracking.
    - `rrn` string — Retrieval Reference Number (RRN). A 12-digit identifier used for transaction lookup and customer service queries.
    - `advice_code` '01' | '02' | '03' | '21' | '85' — Issuer advice code indicating the recommended action after a decline. Helps merchants implement intelligent retry strategies. - `01`: New attempt may succeed. Retry recommended. - `02`: Do not retry. Try a different payment method. - `03`: Do not retry. Cardholder should contact their issuer. - `21`: Cancel all pending authorizations. Card may be compromised. - `85`: Do not retry. Issuer will not approve this transaction type.
    - `authentication_data` object — Authentication and verification data for this payment attempt.
      - `cvv_result` 'M' | 'N' | 'P' | 'U' — CVV/CVC verification result returned by the issuer. - `M`: Match. - `N`: No match. - `P`: Not processed. - `U`: Unsupported.
      - `avs_result` string — Address Verification System (AVS) result. Indicates whether the billing address provided matches the issuer's records.
      - `three_ds` CardThreeDSResponse
        - `three_ds_version` string — The 3D Secure protocol version used for authentication.
        - `eci` string — Electronic Commerce Indicator. A two-digit code indicating the security level of the transaction and the liability shift outcome.
        - `cavv` string — Cardholder Authentication Verification Value. A cryptographic value generated by the issuer's Access Control Server confirming successful authentication.
        - `three_ds_authentication_status` 'Y' | 'A' | 'N' | 'U' | 'R' | 'C' — The result of the 3DS authentication. - `Y`: Authentication successful. - `A`: Authentication attempted. Liability shift is granted but full authentication was not completed. - `N`: Authentication failed or denied. - `U`: Authentication could not be performed due to technical or other issues. - `R`: Authentication rejected by the issuer. - `C`: Challenge required. Additional verification steps are needed.
        - `three_ds_cancellation_reason` string — The reason the 3DS authentication flow was cancelled, if applicable.
    - `payment_method` union — The payment method details to confirm the PaymentIntent. The PaymentIntent will be confirmed automatically when `payment_method` is set.
      - object
        - `type` 'card', required
        - `card` object, required
          - `card_name` string, required — Card holder name. Maximum length is 128.
          - `card_number` string, required — Masked card number. First 6 digits (BIN) and last 4 digits are visible.
          - `network` 'visa' | 'mastercard' | 'unionpay', required — The card network. Examples include `visa`, `mastercard`, `unionpay`.
          - `brand` string — The card brand.
          - `bin` string — Bank Identification Number. The first 6–8 digits of the card number identifying the issuing institution.
          - `last4` string — The last four digits of the card number.
          - `card_type` 'credit' | 'debit' | 'prepaid' — The card funding type.
          - `expiry_month` string — Two-digit expiry month of the card.
          - `expiry_year` string — Four-digit expiry year of the card.
          - `billing` CardBilling — Billing information of the customer.
            - `first_name` string, required — First name of the customer. Maximum length is 128.
            - `last_name` string, required — Last name of the customer. Maximum length is 128.
            - `email` string, email, required — Email address of the customer.
            - `phone_number` string — Phone number of the customer.
            - `address` Address, required
              - …
          - `auto_capture` boolean — Specifies whether the funds should be requested automatically after the payment is authorized. Default to `true`. Set it to `false` if you want to capture the funds sometimes later.
          - `authorization_type` 'authorization' | 'pre_authorization', required — The authorization type for the card payment. Options are `authorization` (default) and `pre_authorization`. Use `pre_authorization` to hold funds for more than 7 days, available only for Visa and Mastercard. `auto_capture` must be `false` for pre-authorization.
      - object
        - `type` 'applepay', required
        - `applepay` object, required — Apple Pay payment information returned in the response.
          - `flow` 'redirect' | 'mobile_web' | 'mobile_app' | 'contactless' — The checkout flow used for this payment.
          - `os_type` 'ios' — The operating system type of the customer device.
          - `is_present` boolean — Whether this is an in-person (offline) payment.
          - `network` 'visa' | 'mastercard' | 'amex' | 'discover' | 'jcb'
          - `card_type` 'debit' | 'credit' — The type of card used (e.g., credit, debit).
          - `token_type` 'decrypted' | 'encrypted'
          - `auth_method` 'cryptogram_3ds' | 'pan_only'
      - object
        - `type` 'googlepay', required
        - `googlepay` object, required — Google Pay payment information returned in the response.
          - `flow` 'redirect' | 'mobile_web' | 'mobile_app' | 'contactless' — The checkout flow used for this payment.
          - `os_type` 'ios' | 'android' — The operating system type of the customer device.
          - `is_present` boolean — Whether this is an in-person (offline) payment.
          - `network` 'visa' | 'mastercard' | 'amex' | 'discover' | 'jcb'
          - `card_type` 'debit' | 'credit' — The type of card used (e.g., credit, debit).
          - `token_type` 'decrypted' | 'encrypted'
          - `auth_method` 'cryptogram_3ds' | 'pan_only'
      - object
        - `type` 'alipaycn', required
        - `alipaycn` object, required — AlipayCN payment information returned in the response.
          - `flow` 'qrcode' — The checkout flow used for this payment.
          - `os_type` 'ios' | 'android' — The operating system type of the customer device.
          - `is_present` boolean — Whether this is an in-person (offline) payment.
      - object
        - `type` 'alipayhk', required
        - `alipayhk` object, required — AlipayHK payment information returned in the response.
          - `flow` 'qrcode' — The checkout flow used for this payment.
          - `os_type` 'ios' | 'android' — The operating system type of the customer device.
          - `is_present` boolean — Whether this is an in-person (offline) payment.
      - object
        - `type` 'unionpay', required
        - `unionpay` object, required — UnionPay payment information returned in the response.
          - `flow` 'qrcode' | 'securepay' — The checkout flow used for this payment.
          - `os_type` 'ios' | 'android' — The operating system type of the customer device.
          - `is_present` boolean — Whether this is an in-person (offline) payment.
      - object
        - `type` 'wechatpay', required
        - `wechatpay` object, required — WeChat Pay payment information returned in the response.
          - `flow` 'qrcode' | 'mini_program' | 'mobile_app' | 'mobile_web' | 'official_account' — The checkout flow used for this payment.
          - `os_type` 'ios' | 'android' — The operating system type of the customer device.
          - `is_present` boolean — Whether this is an in-person (offline) payment.
      - object
        - `type` 'grabpay', required
        - `grabpay` object, required — GrabPay payment information returned in the response.
          - `flow` 'qrcode' — The checkout flow used for this payment.
          - `os_type` 'ios' | 'android' — The operating system type of the customer device.
          - `is_present` boolean — Whether this is an in-person (offline) payment.
          - `shopper_name` string — The name of the shopper.
      - object
        - `type` 'crypto', required
        - `crypto` object, required — Cryptocurrency payment information returned in the response.
          - `flow` 'redirect' | 'qrcode' — The checkout flow used for this payment.
          - `network` 'ETH' | 'TRON'
          - `is_present` boolean — Whether this is an in-person (offline) payment.
      - object
        - `type` 'paynow', required
        - `paynow` object, required — PayNow payment information returned in the response.
          - `flow` 'qrcode' — The checkout flow used for this payment.
          - `is_present` boolean — Whether this is an in-person (offline) payment.
      - object
        - `type` 'truemoney', required
        - `truemoney` object, required — Truemoney payment information returned in the response.
          - `flow` 'qrcode' — The checkout flow used for this payment.
          - `os_type` 'ios' | 'android' — The operating system type of the customer device.
          - `is_present` boolean — Whether this is an in-person (offline) payment.
      - object
        - `type` 'tng', required
        - `tng` object, required — Touch'n Go payment information returned in the response.
          - `flow` 'qrcode' — The checkout flow used for this payment.
          - `os_type` 'ios' | 'android' — The operating system type of the customer device.
          - `is_present` boolean — Whether this is an in-person (offline) payment.
      - object
        - `type` 'gcash', required
        - `gcash` object, required — GCash payment information returned in the response.
          - `flow` 'qrcode' — The checkout flow used for this payment.
          - `os_type` 'ios' | 'android' — The operating system type of the customer device.
          - `is_present` boolean — Whether this is an in-person (offline) payment.
      - object
        - `type` 'dana', required
        - `dana` object, required — Dana payment information returned in the response.
          - `flow` 'qrcode' — The checkout flow used for this payment.
          - `os_type` 'ios' | 'android' — The operating system type of the customer device.
          - `is_present` boolean — Whether this is an in-person (offline) payment.
      - object
        - `type` 'kakaopay', required
        - `kakaopay` object, required — KakaoPay payment information returned in the response.
          - `flow` 'qrcode' — The checkout flow used for this payment.
          - `os_type` 'ios' | 'android' — The operating system type of the customer device.
          - `is_present` boolean — Whether this is an in-person (offline) payment.
      - object
        - `type` 'toss', required
        - `toss` object, required — Toss Pay payment information returned in the response.
          - `flow` 'qrcode' — The checkout flow used for this payment.
          - `os_type` 'ios' | 'android' — The operating system type of the customer device.
          - `is_present` boolean — Whether this is an in-person (offline) payment.
      - object
        - `type` 'naverpay', required
        - `naverpay` object, required — Naver Pay payment information returned in the response.
          - `flow` 'qrcode' — The checkout flow used for this payment.
          - `os_type` 'ios' | 'android' — The operating system type of the customer device.
          - `is_present` boolean — Whether this is an in-person (offline) payment.
    - `failure_code` string — PaymentAttempt failure code. Possible values are defined in [Error Code Reference.payment_error](/global-acquiring/v1.6/guide/error-codes) section.
    - `attempt_status` 'INITIATED' | 'AUTHENTICATION_REDIRECTED' | 'PENDING_AUTHORIZATION' | 'AUTHORIZED' | 'CAPTURE_REQUESTED' | 'SETTLED' | 'SUCCEEDED' | 'CANCELLED' | 'EXPIRED' | 'FAILED' — The status of the attempt. - `INITIATED`: The payment attempt has been created based on the initial request. - `AUTHENTICATION_REDIRECTED`: Waiting for the customer to complete identity verification, such as 3D Secure or QR code scanning. - `PENDING_AUTHORIZATION`: The authorization request has been received and is pending a final decision from the payment provider. - `AUTHORIZED`: The authorization has been successfully completed. Payment will be captured automatically or manually depending on configuration. - `CAPTURE_REQUESTED`: The capture request has been submitted successfully, and the payment is considered complete. - `SETTLED`: Funds have been settled from the payment provider and received by UQPAY. - `SUCCEEDED`: UQPAY has settled funds to your wallet. - `CANCELLED`: The payment attempt has been cancelled. Any authorized funds, if applicable, will be returned to the customer. - `EXPIRED`: The payment attempt was not completed within the allowed time window and has expired. - `FAILED`: The payment attempt has failed. Please create a new PaymentAttempt to retry.
  - `intent_status` 'REQUIRES_PAYMENT_METHOD' | 'REQUIRES_CUSTOMER_ACTION' | 'REQUIRES_CAPTURE' | 'PENDING' | 'SUCCEEDED' | 'CANCELLED' | 'FAILED', required — Status of this PaymentIntent. - `REQUIRES_PAYMENT_METHOD`: The PaymentIntent is waiting for the confirm request. - `REQUIRES_CUSTOMER_ACTION`: The PaymentIntent is waiting for further customer action of authentication, e.g. 3DS verification and QR code scan. Please check the `next_action`. - `REQUIRES_CAPTURE`: The PaymentIntent is waiting for your capture to complete the payment. - `PENDING`: The PaymentIntent is pending the final result from the provider. No further action is required. - `SUCCEEDED`: The PaymentIntent has succeeded. The payment is complete. - `CANCELLED`: The PaymentIntent has been canceled by your request. The payment is closed. - `FAILED`: The PaymentIntent has failed.

---

[API](https://skmtc.dev/uqpay/apis/authentication-api.md) · [All operations](https://skmtc.dev/uqpay/apis/authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/uqpay/authentication-api/revisions/cef532a10777/schema)