SCA-ready payments without building your own payment gateway integration
WPBay accepts major credit and debit cards through Stripe and also supports PayPal. When a European payment requires additional authentication, the payment provider and the customer’s bank can handle the required verification through the WPBay checkout flow.
- Stripe card payments
- PayPal payments
- 3D Secure support
- Strong Customer Authentication
- European PSD2 payments
- UK payment authentication
- Subscription payments
- No seller gateway integration
Your bank may ask you to confirm the payment using its app, a one-time code, biometric verification or another supported authentication method.
SCA adds stronger verification to electronic payments
Strong Customer Authentication was introduced through Europe’s PSD2 payment rules to reduce fraud and make electronic payments more secure.
When SCA applies, the customer must be authenticated using at least two independent elements from different authentication categories.
That does not mean every customer has to type two passwords or complete a visible two-step process on every purchase. Payment providers and banks can use modern authentication flows that are much less disruptive.
Authentication happens only when the payment flow requires it
SCA is part of the payment infrastructure, not a second login system that every WordPress developer has to create.
The issuing bank decides
The customer’s bank plays a central role in deciding whether a card transaction can proceed normally or needs additional authentication.
3D Secure can authenticate cards
3D Secure is commonly used for online card authentication and allows the customer’s bank to request additional verification when needed.
Bank-app confirmation
A customer may be asked to open their banking app and approve a transaction rather than enter information directly in the checkout.
Biometric verification
Depending on the customer’s bank and device, authentication may use a fingerprint, face recognition or another supported method.
One-time codes
Some issuers may authenticate customers with a one-time password, SMS code or other secure verification process.
Some payments remain frictionless
Transactions that qualify for an exemption or pass a low-risk assessment may complete without presenting an extra authentication challenge.
More authentication does not always mean more checkout friction
Modern 3D Secure flows allow payment providers and card issuers to exchange additional transaction information before deciding whether the cardholder must actively authenticate.
The result is usually one of two experiences: a frictionless payment or a challenge from the customer’s bank.
Stripe for cards. PayPal for PayPal payments.
WPBay sellers do not create separate payment-gateway integrations for their individual products.
Stripe
WPBay accepts major credit and debit cards through Stripe. Stripe’s modern payment infrastructure supports Strong Customer Authentication and 3D Secure for applicable European card transactions.
- 3D Secure authentication
- Issuer challenge flows
- Frictionless authentication where possible
- SCA exemption handling
- Recurring-payment support
- Off-session payment flows
PayPal
WPBay also accepts PayPal. PayPal can apply the authentication required for its checkout flow and its current standard checkout documentation states that PayPal manages 3D Secure authentication automatically for standard integrations.
- PayPal account authentication
- Strong Customer Authentication support
- 3D Secure support where relevant
- PayPal app confirmation
- One-time authentication codes
- Recurring-payment support
SCA includes exemptions and out-of-scope payment flows
Payment providers can use the appropriate transaction information to request exemptions or identify payments that fall outside normal customer-initiated SCA requirements.
Low-value transactions
Certain low-value payments can qualify for an SCA exemption, although cumulative and issuer rules can still trigger authentication.
Transaction risk analysis
Eligible payments assessed as sufficiently low risk can potentially qualify for an exemption, subject to regulatory thresholds and issuer acceptance.
Recurring payments
After a recurring payment arrangement has been authenticated and established correctly, subsequent qualifying recurring charges may not need the customer to authenticate every renewal.
Merchant-initiated transactions
Properly established off-session merchant-initiated payments can fall outside normal customer-initiated SCA requirements.
Trusted beneficiaries
Customers may be able to designate merchants as trusted beneficiaries through their payment provider or bank, subject to the applicable rules.
The bank can still challenge
An exemption does not guarantee a frictionless payment. The card issuer can still require authentication before authorizing the transaction.
Customers should not need to re-authenticate every normal renewal
Recurring billing is one of the most important areas for software sellers.
When a customer first creates a subscription, the payment method may need to be authenticated and permission established for future charges.
Subsequent qualifying recurring charges can then be treated as merchant-initiated or recurring payments, avoiding a requirement for the customer to return to checkout for every scheduled renewal.
Banks can still request authentication in specific situations, particularly when payment details change or a transaction falls outside the established recurring arrangement.
You do not need to implement PSD2 and 3D Secure inside your WordPress product
WPBay operates the marketplace checkout and is the Merchant of Record for standard purchases.
WPBay handles
The payment infrastructure for standard marketplace transactions.
- Marketplace checkout
- Stripe card-payment integration
- PayPal payment integration
- Payment-provider authentication flows
- 3D Secure flows where required
- Subscription billing infrastructure
- Customer payment records
- Payment failures and transaction status
- Refund administration
- Chargebacks and payment disputes
Sellers focus on
The software product and customer experience around it.
- Building and maintaining the product
- Setting clear prices
- Explaining subscription billing terms
- Providing accurate product information
- Supporting customers using the product
- Keeping the product compatible and updated
- Directing marketplace billing issues to WPBay
- Managing payment compliance on any separate direct-sales channels you operate yourself
Most of the complexity stays behind the checkout
From the customer’s perspective, authentication depends on their payment method, bank, device, transaction and risk assessment.
Two buyers purchasing the same WordPress plugin may therefore see different payment experiences.
A failed SCA check does not necessarily mean the card is invalid
Authentication can fail before the actual payment is approved.
Complete the bank challenge
Check whether the issuing bank is waiting for approval in its mobile app, browser window or another authentication channel.
Retry the payment
If authentication timed out or was cancelled, starting the checkout again may create a fresh authentication request.
Try another payment method
A buyer who cannot complete their card authentication may be able to use another card or PayPal instead.
Check with the bank
The issuing bank controls the authentication and authorization decision and may be able to explain why the transaction was rejected.
Contact WPBay for checkout issues
Marketplace payment and billing issues belong to WPBay rather than the individual plugin or theme developer.
Don’t ask the seller to fix the card
WPBay sellers do not control the customer’s bank, Stripe authentication or PayPal authentication flow.
SCA questions for WPBay sellers and customers
What is Strong Customer Authentication?
Strong Customer Authentication is a payment-security requirement introduced under Europe’s PSD2 framework. When required, authentication must use at least two independent elements from the categories of knowledge, possession and inherence.
Does every European card payment require a visible 3D Secure challenge?
No. Some payments qualify for exemptions, some fall outside normal customer-initiated SCA requirements, and modern 3D Secure can support frictionless flows. The card issuer ultimately determines whether a customer challenge is necessary.
What is 3D Secure?
3D Secure is a card-authentication protocol that allows the customer’s issuing bank to verify the cardholder during an online purchase. Modern 3D Secure flows can either complete frictionlessly or present an additional authentication challenge.
Does WPBay use Stripe?
Yes. WPBay accepts major credit and debit cards through Stripe.
Does WPBay accept PayPal?
Yes. PayPal is also available as a WPBay payment method.
Does PayPal support Strong Customer Authentication?
Yes. PayPal supports SCA and 3D Secure flows where applicable. PayPal’s current developer documentation states that standard PayPal Checkout integrations handle 3D Secure authentication automatically.
Does Stripe support Strong Customer Authentication?
Yes. Stripe supports SCA-aware payment flows and 3D Secure authentication for applicable European card transactions, including challenge and frictionless flows.
Will a subscription customer authenticate every month?
Normally not. The initial payment or setup of the payment method may require authentication. Properly established subsequent recurring or merchant-initiated transactions can generally be processed without requiring the customer to authenticate every normal scheduled renewal, although a bank can still request customer action in some circumstances.
Do WPBay sellers need to integrate 3D Secure themselves?
Not for standard WPBay marketplace purchases. WPBay operates the customer checkout and payment processing as Merchant of Record. Individual sellers do not maintain separate Stripe or PayPal checkout integrations for each product.
Does this cover sales through my own website?
No. If you also sell directly through your own checkout, you are responsible for ensuring that your own payment integration supports the authentication and payment regulations that apply to those transactions.
What if a customer’s card payment fails during authentication?
The customer should complete any request from their bank, retry the checkout, use another payment method or contact their card issuer. For WPBay checkout or billing issues, the customer should contact WPBay rather than the individual product developer.
Sell WordPress products without building your own Stripe, PayPal or 3D Secure checkout
WPBay provides the marketplace checkout and payment-processing layer, allowing you to concentrate on your plugin, theme, script or service instead of maintaining payment authentication infrastructure for every product you sell.