--- title: "Zero Authorization" method: POST path: "/checkout/zero-authorization/{merchantId}" tags: ["checkout"] --- # Zero Authorization `POST /checkout/zero-authorization/{merchantId}` Performs an Authorization transaction on a Card for $0.00 to be validated and stored for future use. This endpoint can only be used if the customer is actively involved in the purchase flow and has explicitly granted their authorization to charge their card. ## Path parameters - `merchantId` string, required ## Headers - `x-coinflow-auth-session-key` string, required - `x-device-id` string - `x-coinflow-client-ip` string ## Request body - union - ZeroAuthorizationCheckoutArgsNewCardWithoutReason - `customPayInFees` CustomPayInFeeConfig[] - `fee` union, required - CustomPayInFeeValue0 - `cents` number, double, required - `currency` 'USD' | 'AED' | 'AFN' | 'ALL' | 'AMD' | 'ANG' | 'AOA' | 'ARS' | 'AUD' | 'AWG' | 'AZN' | 'BAM' | 'BBD' | 'BDT' | 'BGN' | 'BHD' | 'BIF' | 'BMD' | 'BND' | 'BOB' | 'BRL' | 'BSD' | 'BTN' | 'BWP' | 'BYN' | 'BZD' | 'CAD' | 'CHF' | 'CLF' | 'CLP' | 'CNY' | 'COP' | 'CRC' | 'CUP' | 'CVE' | 'CZK' | 'DJF' | 'DKK' | 'DOP' | 'DZD' | 'EGP' | 'ETB' | 'EUR' | 'FJD' | 'GBP' | 'GEL' | 'GHS' | 'GMD' | 'GNF' | 'GTQ' | 'GYD' | 'HKD' | 'HNL' | 'HTG' | 'HUF' | 'IDR' | 'ILS' | 'INR' | 'IQD' | 'IRR' | 'ISK' | 'JMD' | 'JOD' | 'JPY' | 'KES' | 'KGS' | 'KHR' | 'KMF' | 'KRW' | 'KWD' | 'KYD' | 'KZT' | 'LAK' | 'LBP' | 'LKR' | 'LRD' | 'LSL' | 'LYD' | 'MAD' | 'MDL' | 'MGA' | 'MKD' | 'MMK' | 'MNT' | 'MOP' | 'MRU' | 'MUR' | 'MWK' | 'MVR' | 'MXN' | 'MYR' | 'MZN' | 'NAD' | 'NGN' | 'NIO' | 'NOK' | 'NPR' | 'NZD' | 'OMR' | 'PAB' | 'PEN' | 'PGK' | 'PHP' | 'PKR' | 'PLN' | 'PYG' | 'QAR' | 'RON' | 'RSD' | 'RWF' | 'SAR' | 'SCR' | 'SDG' | 'SEK' | 'SGD' | 'SLE' | 'SLL' | 'SOS' | 'SRD' | 'STN' | 'SVC' | 'SYP' | 'SZL' | 'THB' | 'TJS' | 'TMT' | 'TND' | 'TOP' | 'TRY' | 'TTD' | 'TWD' | 'TZS' | 'UAH' | 'UGX' | 'UYU' | 'UZS' | 'VND' | 'VUV' | 'WST' | 'XAF' | 'XCD' | 'XOF' | 'XPF' | 'YER' | 'ZAR' | 'ZMW' | 'ZWL' | 'CDF' | 'ERN' | 'FKP' | 'KPW' | 'RUB' | 'SBD' | 'SHP' | 'SSP' | 'VES', required - `percent` number, double, nullable, required - `isFixed` boolean, required - CustomPayInFeeValue1 - `cents` number, double, nullable, required - `currency` number, double, nullable, required - `percent` number, double, required - `isFixed` boolean, required - `lineItemLabel` string, required - `customerInfo` union - SplitNameCustomerInfo - `verificationId` string - `displayName` string - `address` string - `city` string - `state` string - `zip` string - `country` string - `ip` string - `lat` string - `lng` string - `dob` string — Date of birth in YYYY-MM-DD format - `email` string - `firstName` string, required - `lastName` string, required - NameCustomerInfo - `verificationId` string - `displayName` string - `address` string - `city` string - `state` string - `zip` string - `country` string - `ip` string - `lat` string - `lng` string - `dob` string — Date of birth in YYYY-MM-DD format - `email` string - `name` string - `webhookInfo` AnyObject - `example` string - `statementDescriptor` string — If the bank supports dynamic descriptors, this will appear on the customer's statement. - `stellarTransaction` string — (Stellar only) Base64 XDR transaction string for executing a merchant contract call on a successful purchase. For transaction purchases, pass the base64 XDR string created using `.toXDR()` on a transaction built with generated TypeScript bindings (e.g., `NftClientWrapper.buildNftPurchaseTx`). For direct USDC transfers (no merchant transaction), omit this field or pass undefined. Gas fees for the transaction will be automatically calculated and added to the total charged to the customer. - `authentication3DS` union — 3DS Card Authorization Data On initial payment submission - Device3DSInfo needed: 3DS device information - required if 3DS is enabled After card challenge complete: 3DS challenge transaction id - required after prompted for challenge - Device3DSInfo - `colorDepth` number, double, required - `screenHeight` number, double, required - `screenWidth` number, double, required - `timeZone` number, double, required - `versionInfo` VersionInfo[] - `url` string - `transactionId` string, required - `directoryServer` string, required - `version` string, required - External3DSInfo — External 3DS info, if provided must call the endpoint with API key or checkout JWT. - `transactionId` string, required - `cavv` string, required - `eci` string, required - `dsTransactionId` string, required - `acsTransactionId` string, required - `version` string, required - ConcludeChallenge - `transactionId` string, required - `chargebackProtectionAccountType` 'guest' | 'private' | 'business' - `threeDsChallengePreference` 'NoPreference' | 'Frictionless' | 'Challenge' - `userLocation` IUserLocation — End-user geographic coordinates captured at the moment of the withdrawal request. Consumed by `BlockingRuleMethod.GEOLOCATION` enforcement. Replay-of-different-coords bypass is prevented server-side: the first resolved {country, state} for a given (merchant, user) pair is pinned in Redis, and subsequent requests are evaluated against that pinned value regardless of the lat/lng they submit. - `lat` number, double, required - `lng` number, double, required - `overrideChargebackProtectionDecision` boolean - `doNotReviewChargebackProtection` boolean - `card` union, required - CardData - `cardToken` string, required — This is the card token received from the `CoinflowCardNumberInput` - `expYear` string, required — The Cards Expiration Year ex: 2026 => 26 - `expMonth` string, required — The Cards Expiration Month ex: January => 01 December => 12 - `additionalVendorData` CardDataAdditionalVendorData — Optional non-PCI passthrough fields merged into the stored card vendorData. Base type is empty; tokenization providers extend it with their own fields. - `email` string, required - `businessName` string - `firstName` string, required - `lastName` string, required - `address1` string, required - `city` string, required - `zip` string - `state` string - `country` string, required - CardDataWithoutAddress - `cardToken` string, required — This is the card token received from the `CoinflowCardNumberInput` - `expYear` string, required — The Cards Expiration Year ex: 2026 => 26 - `expMonth` string, required — The Cards Expiration Month ex: January => 01 December => 12 - `additionalVendorData` CardDataWithoutAddressAdditionalVendorData — Optional non-PCI passthrough fields merged into the stored card vendorData. Base type is empty; tokenization providers extend it with their own fields. - `email` string, required - `businessName` string - `firstName` string, required - `lastName` string, required - ZeroAuthorizationCheckoutArgsSavedCardWithoutReason - `customPayInFees` CustomPayInFeeConfig[] - `fee` union, required - CustomPayInFeeValue0 - `cents` number, double, required - `currency` 'USD' | 'AED' | 'AFN' | 'ALL' | 'AMD' | 'ANG' | 'AOA' | 'ARS' | 'AUD' | 'AWG' | 'AZN' | 'BAM' | 'BBD' | 'BDT' | 'BGN' | 'BHD' | 'BIF' | 'BMD' | 'BND' | 'BOB' | 'BRL' | 'BSD' | 'BTN' | 'BWP' | 'BYN' | 'BZD' | 'CAD' | 'CHF' | 'CLF' | 'CLP' | 'CNY' | 'COP' | 'CRC' | 'CUP' | 'CVE' | 'CZK' | 'DJF' | 'DKK' | 'DOP' | 'DZD' | 'EGP' | 'ETB' | 'EUR' | 'FJD' | 'GBP' | 'GEL' | 'GHS' | 'GMD' | 'GNF' | 'GTQ' | 'GYD' | 'HKD' | 'HNL' | 'HTG' | 'HUF' | 'IDR' | 'ILS' | 'INR' | 'IQD' | 'IRR' | 'ISK' | 'JMD' | 'JOD' | 'JPY' | 'KES' | 'KGS' | 'KHR' | 'KMF' | 'KRW' | 'KWD' | 'KYD' | 'KZT' | 'LAK' | 'LBP' | 'LKR' | 'LRD' | 'LSL' | 'LYD' | 'MAD' | 'MDL' | 'MGA' | 'MKD' | 'MMK' | 'MNT' | 'MOP' | 'MRU' | 'MUR' | 'MWK' | 'MVR' | 'MXN' | 'MYR' | 'MZN' | 'NAD' | 'NGN' | 'NIO' | 'NOK' | 'NPR' | 'NZD' | 'OMR' | 'PAB' | 'PEN' | 'PGK' | 'PHP' | 'PKR' | 'PLN' | 'PYG' | 'QAR' | 'RON' | 'RSD' | 'RWF' | 'SAR' | 'SCR' | 'SDG' | 'SEK' | 'SGD' | 'SLE' | 'SLL' | 'SOS' | 'SRD' | 'STN' | 'SVC' | 'SYP' | 'SZL' | 'THB' | 'TJS' | 'TMT' | 'TND' | 'TOP' | 'TRY' | 'TTD' | 'TWD' | 'TZS' | 'UAH' | 'UGX' | 'UYU' | 'UZS' | 'VND' | 'VUV' | 'WST' | 'XAF' | 'XCD' | 'XOF' | 'XPF' | 'YER' | 'ZAR' | 'ZMW' | 'ZWL' | 'CDF' | 'ERN' | 'FKP' | 'KPW' | 'RUB' | 'SBD' | 'SHP' | 'SSP' | 'VES', required - `percent` number, double, nullable, required - `isFixed` boolean, required - CustomPayInFeeValue1 - `cents` number, double, nullable, required - `currency` number, double, nullable, required - `percent` number, double, required - `isFixed` boolean, required - `lineItemLabel` string, required - `token` string, required - `customerInfo` union - SplitNameCustomerInfo - `verificationId` string - `displayName` string - `address` string - `city` string - `state` string - `zip` string - `country` string - `ip` string - `lat` string - `lng` string - `dob` string — Date of birth in YYYY-MM-DD format - `email` string - `firstName` string, required - `lastName` string, required - NameCustomerInfo - `verificationId` string - `displayName` string - `address` string - `city` string - `state` string - `zip` string - `country` string - `ip` string - `lat` string - `lng` string - `dob` string — Date of birth in YYYY-MM-DD format - `email` string - `name` string - `webhookInfo` AnyObject - `example` string - `statementDescriptor` string — If the bank supports dynamic descriptors, this will appear on the customer's statement. - `stellarTransaction` string — (Stellar only) Base64 XDR transaction string for executing a merchant contract call on a successful purchase. For transaction purchases, pass the base64 XDR string created using `.toXDR()` on a transaction built with generated TypeScript bindings (e.g., `NftClientWrapper.buildNftPurchaseTx`). For direct USDC transfers (no merchant transaction), omit this field or pass undefined. Gas fees for the transaction will be automatically calculated and added to the total charged to the customer. - `authentication3DS` union — 3DS Card Authorization Data On initial payment submission - Device3DSInfo needed: 3DS device information - required if 3DS is enabled After card challenge complete: 3DS challenge transaction id - required after prompted for challenge - Device3DSInfo - `colorDepth` number, double, required - `screenHeight` number, double, required - `screenWidth` number, double, required - `timeZone` number, double, required - `versionInfo` VersionInfo[] - `url` string - `transactionId` string, required - `directoryServer` string, required - `version` string, required - External3DSInfo — External 3DS info, if provided must call the endpoint with API key or checkout JWT. - `transactionId` string, required - `cavv` string, required - `eci` string, required - `dsTransactionId` string, required - `acsTransactionId` string, required - `version` string, required - ConcludeChallenge - `transactionId` string, required - `chargebackProtectionAccountType` 'guest' | 'private' | 'business' - `threeDsChallengePreference` 'NoPreference' | 'Frictionless' | 'Challenge' - `userLocation` IUserLocation — End-user geographic coordinates captured at the moment of the withdrawal request. Consumed by `BlockingRuleMethod.GEOLOCATION` enforcement. Replay-of-different-coords bypass is prevented server-side: the first resolved {country, state} for a given (merchant, user) pair is pinned in Redis, and subsequent requests are evaluated against that pinned value regardless of the lat/lng they submit. - `lat` number, double, required - `lng` number, double, required - `overrideChargebackProtectionDecision` boolean - `doNotReviewChargebackProtection` boolean ## Response `200` Ok - CardCheckoutResponse - `paymentId` string, required — The ID of the payment that was created. - `authorizationExpiration` string — The datetime when this authorization expires and subsequent card-on-file or merchant-initiated transactions can no longer be made. After this time, the card must be re-authorized via another CIT transaction. Only present when card-on-file or MIT settings are enabled on the merchant. ## Other responses - `403` — Zero Authorization not enabled - `410` — Validation for this card has expired. Revalidate the CVV for this card, and make a new purchase using the /api/checkout/card/token in order to begin using this endpoint again. - `412` — 3DS Challenge required --- [API](https://skmtc.net/coinflow/apis/api-reference.md) · [All operations](https://skmtc.net/coinflow/apis/api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/coinflow/api-reference/versions/c7b5afab1295/schema)