**Last updated**: 22 April 2025 | [**Change log**](/products/3ds/changelog/)

# Device Data

The card issuer uses Device Data Collection (DDC) to fingerprint the customer's device.

Along with the risk data in the [authentication](/products/3ds/web/authentication) request, it's used to decide if a [challenge](/products/3ds/web/challenge-verification) is needed or if the authentication can be frictionless (no challenge displayed to your customer).

Important
Invoke this process immediately upon the customer providing their payment credentials. This ensures that DDC processes asynchronously behind the scenes as the customer completes the remaining checkout process. If a customer changes their card number after the DDC process is started or completed, re-execute the entire DDC process.

## Device data initialization

`POST` your device data initialization request to the `3ds:deviceDataInitialize` action link.

This request creates a JSON Web Token (JWT) that is used as part of the DDC form. The DDC form also requires the first six digits of your customer's card number (BIN). The BIN can be returned if a token resource is provided, see `JWT + BIN (token)` request.

For consistency of integration you can also provide the full card number `JWT + BIN (card)`  or `JWT + BIN (Network Token)`. It is truncated to become the BIN in the response.

### Device data initialization example request

Card (JWT + BIN)
Token (JWT + BIN)
Network Token (JWT + BIN)
JWT only
### Device data initialization response

Best practice
Access Worldpay returns a `WP-CorrelationId` in the headers of service responses. We highly recommend you log this. The `WP-CorrelationId` is used by us to examine individual service requests.

To understand what these outcomes mean and how to reproduce them for testing purposes see [3DS testing](/products/3ds/testing)

JWT + BIN returned
JWT & BIN returned
  {
      "outcome": "initialized",
      "transactionReference": "Memory265-13/08/1876",
      "deviceDataCollection": {
          "jwt": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJPcmdVbml0SWQiOiJPcmdVbml0IiwiaXNzIjoiYXBpSWQiLCJleHAiOjE1NjI5MjMzNDYsImlhdCI6MTU2MjkyMzQwNiwianRpIjoiYTAzMWVhOGEtN2E0Zi00YTQwLWI1NjMtOTUzMzYzMzVhZGNmIn0.0IK74OIXBxFsxqeOURJz1TFnz14ZTbFJTdTWo9cHUJQ",
          "url": "https://ddcUrl.example.com",
          "bin": "555555"
      },
      "_links": {
          "3ds:authenticate": {
              "href": "https://try.access.worldpay.com/verifications/customers/3ds/authentication"
          },
          "curies": [
              {
                  "href": "https://try.access.worldpay.com/rels/verifications/customers/3ds/{rel}",
                  "templated": true,
                  "name": "3ds"
              }
          ]
      }
  }
JWT only
Only JWT returned
  {
      "outcome": "initialized",
      "transactionReference": "Memory265-13/08/1876",
      "deviceDataCollection": {
          "jwt": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJPcmdVbml0SWQiOiJPcmdVbml0IiwiaXNzIjoiYXBpSWQiLCJleHAiOjE1NjI5MjMzNDYsImlhdCI6MTU2MjkyMzQwNiwianRpIjoiYTAzMWVhOGEtN2E0Zi00YTQwLWI1NjMtOTUzMzYzMzVhZGNmIn0.0IK74OIXBxFsxqeOURJz1TFnz14ZTbFJTdTWo9cHUJQ",
          "url": "https://ddcUrl.example.com"
      },
      "_links": {
          "3ds:authenticate": {
              "href": "https://try.access.worldpay.com/verifications/customers/3ds/authentication"
          },
          "curies": [
              {
                  "href": "https://try.access.worldpay.com/rels/verifications/customers/3ds/{rel}",
                  "templated": true,
                  "name": "3ds"
              }
          ]
      }
  }
The `DeviceDataCollection` object will be used for the next step.

Note
In case of an error, you can get further information in our [error reference](/products/reference/worldpay-error-responses).

## Device Data Collection (DDC)

Once you have the `JWT`, `URL` and `BIN` you can create and submit the DDC form.

The issuer uses a `SessionId` representing this collection as part of the risk analysis in the [authentication request](/products/3ds/web/authentication).

### Test Data Collection form

Here's an example of how you would set-up the DDC form in an iframe.

1. Create a hidden iframe and set the `src` attribute with the URL of the page that POSTs the DDC form.
This URL should contain in query string parameters the `deviceDataCollection.jwt`, `deviceDataCollection.bin` and `deviceDataCollection.url` as those are used in the DDC form.


iframe for DDC form
<iframe height="1" width="1" style="display: none;" src="replace-this-with-the-url-of-your-page-that-posts-the-ddc-form"></iframe>
1. Create and host the page that POSTs the DDC form.


DDC form
<html>
<head>
</head>
<body>
<!-- Using your preferred programming language, set the 'action' attribute with the value of the query string parameter containing the 'deviceDataCollection.url' from the device data initialization response -->
<form id="collectionForm" name="devicedata" method="POST" action="https://ddcUrl.example.com">

<!-- Using your preferred programming language, set the 'value' attribute with the value of the query string parameter containing the 'deviceDataCollection.bin' from the device data initialization response -->
<input type="hidden" name="Bin" value="555555" />


<!-- Using your preferred programming language, set the 'value' attribute with the value of the query string parameter containing the 'deviceDataCollection.jwt' from the device data initialization response -->

 <input type="hidden" name="JWT" value="eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJPcmdVbml0SWQiOiJPcmdVbml0IiwiaXNzIjoiYXBpSWQiLCJleHAiOjE1NjI5MjMzNDYsImlhdCI6MTU2MjkyMzQwNiwianRpIjoiYTAzMWVhOGEtN2E0Zi00YTQwLWI1NjMtOTUzMzYzMzVhZGNmIn0.0IK74OIXBxFsxqeOURJz1TFnz14ZTbFJTdTWo9cHUJQ" />

</form>

<script>
window.onload = function() {
  document.getElementById('collectionForm').submit();
 }
</script>
</body>
</html>

### Example device data form

The form below allows you to submit the 3DS device data details provided in the API response. You then receive the sessionId/collectionReference, back in the postMessage, for use in the [authentication](/products/3ds/web/authentication) request. This is useful if using tools such as postman/insomnia to test your integration.

Access 3ds - Device Data Collection form
### Device Data Collection postMessage

Once the DDC form is submitted and is successfully sent to the card issuer, you are notified via a [postMessage](https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage) event.

For security, verify the sender's identity using the postMessage `origin` property as detailed [here](https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage).

| Environment | Origin |
|  --- | --- |
| Try | https://centinelapistag.cardinalcommerce.com |
| Production | https://centinelapi.cardinalcommerce.com |


An example postMessage response:

postmessage
{
    "MessageType": "profile.completed",
    "SessionId": "0_3XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXX6b5",
    "Status": true
}
| Key | Value |
|  --- | --- |
| `messageType` | `profile.completed` |
| `SessionId` | UUID, not present or `undefined` |
| `Status` | `true` - Use the `SessionId` value in `deviceData.collectionReference` as part of the [Authentication request](/products/3ds/web/authentication)`false` -  SessionId is empty. Either retry DDC or send the authentication request without the `deviceData.collectionReference`. |


The DDC call typically takes 1-2 seconds, depending on the latency between the customer's device, the Cardinal servers and, in part, the type of device data collection performed by the different issuers. The 3DS specification has the maximum response time at 10 seconds.

Note
If no postMessage is provided either retry DDC or send the [Authentication request](/products/3ds/web/authentication) without the `deviceData.collectionReference`. We **highly recommend** [providing device data](/products/3ds/web/authentication#how-much-data-to-provide) (e.g. browserScreenHeight) in the authentication request as well. This maximizes authentication rates in the case of DDC failure.

**Next steps**

[Authentication](/products/3ds/web/authentication)