> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dodopayments.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Credit & Debit Cards

> Accept major credit and debit card networks worldwide with Dodo Payments. Covers 3D Secure, saved cards, tokenization, test cards, and regional networks.

Cards are available on every Dodo Payments checkout, in every supported country and currency. Dodo Payments accepts the major card networks, replaces card numbers with tokens, and runs the checks that card payments need, so you don't handle raw card data.

## Supported Card Networks

Dodo Payments accepts global networks and several regional networks.

### Global Networks

| Network | Coverage |
| :- | :- |
| **Visa** | Global leader, 4B+ cards worldwide |
| **Mastercard** | Global reach, strong security features |
| **American Express** | Premium cardholders, higher spending |
| **Discover** | US-focused, growing globally |
| **JCB** | Leading in Japan, expanding across Asia |
| **UnionPay** | Dominant in China |
| **Diners Club** | Premium international travelers |

### Regional Networks

| Network | Region |
| :- | :- |
| **Interac** | Canada's debit network |
| **Cartes Bancaires** | France's national network |
| **Korean Local Cards** | Korean domestic networks |
| **Rupay** | India's national network |

## Configuration

Cards use two values in `allowed_payment_method_types`:

| Type | Description |
| :- | :- |
| `credit` | All credit cards |
| `debit` | All debit cards |

This session offers card payments only:

```javascript theme={null}
// `client` is an initialized DodoPayments client.
const session = await client.checkoutSessions.create({
  product_cart: [{ product_id: 'pdt_123', quantity: 1 }],
  allowed_payment_method_types: ['credit', 'debit'],
  return_url: 'https://example.com/success'
});
```

<Tip>
  Include both `credit` and `debit` unless you have a specific reason to exclude one. Many customers prefer to pay by debit card.
</Tip>

## 3D Secure Authentication

3D Secure (3DS) asks the cardholder's bank to confirm the cardholder's identity, for example with a one-time code, a biometric check, or approval in the bank's app. This reduces fraud and chargebacks.

### When 3DS is Triggered

Dodo Payments requests 3DS when:

* The card network requires it.
* A regional regulation requires it, such as PSD2 in Europe.
* The transaction is flagged as high-risk.

### Force 3DS

To require 3DS on every card payment for your business, turn on **3D Secure** under **Settings → Pricing**. To override that setting for one checkout session, pass `force_3ds`:

```javascript theme={null}
// `client` is an initialized DodoPayments client.
const session = await client.checkoutSessions.create({
  product_cart: [{ product_id: 'pdt_123', quantity: 1 }],
  force_3ds: true,
  return_url: 'https://example.com/success'
});
```

<Note>
  Requiring 3DS on every transaction reduces fraud but can lower conversion, because some customers abandon checkout during authentication.
</Note>

### Handling Authentication Failures

When a payment needs 3DS authentication, the payment moves through intermediate states before it succeeds or fails:

| Status | Meaning | What to do |
| - | - | - |
| `requires_customer_action` | The customer must complete a 3DS challenge | Have the customer complete authentication during checkout |
| `requires_payment_method` | The customer never provided a payment method (didn't enter details or abandoned the prompt). This is usually a drop-off, not a decline | Re-engage the customer to complete checkout. See [Abandoned Cart Recovery](/features/recovery/abandoned-cart-recovery) |

If authentication doesn't complete, the payment fails with one of these decline codes:

* `AUTHENTICATION_FAILURE`: the customer could not be authenticated.
* `AUTHENTICATION_REQUIRED`: authentication is required but was not performed.
* `AUTHENTICATION_TIMEOUT`: the customer did not respond in time.

The [Transaction Failures](/api-reference/transaction-failures) reference lists the recommended action for each code.

#### At Checkout vs. on Renewal

* **At checkout (customer present):** The 3DS challenge appears during checkout. If it fails, ask the customer to retry or use another card.
* **On subscription renewal (customer not present):** A 3DS challenge can't be shown in real time. If a renewal requires authentication and fails, the subscription moves to `on_hold`, or to `past_due` first if you set a [grace period](/features/subscription#grace-period). To recover it, prompt the customer to return and update their payment method. See [Handle Payment Failures](/developer-resources/handle-payment-failures) and [Subscription Dunning](/features/recovery/subscription-dunning).

## Saved Payment Methods

Returning customers can pay with a card saved from an earlier checkout.

<CardGroup cols={3}>
  <Card title="Tokenized" icon="lock">
    Original card numbers are never stored.
  </Card>

  <Card title="PCI Compliant" icon="shield-check">
    Dodo Payments handles PCI compliance.
  </Card>

  <Card title="Customer-Scoped" icon="user">
    Each saved card belongs to one customer.
  </Card>
</CardGroup>

### Enable Saved Cards

To show a returning customer's saved cards at checkout, pass `show_saved_payment_methods: true` with the existing `customer_id`. The default is `false`.

```javascript theme={null}
// `client` is an initialized DodoPayments client.
const session = await client.checkoutSessions.create({
  product_cart: [{ product_id: 'pdt_123', quantity: 1 }],
  show_saved_payment_methods: true,
  customer: { customer_id: 'cus_existing_123' },
  return_url: 'https://example.com/success'
});
```

### One-Click Purchases

To charge a saved card without showing checkout, pass its `payment_method_id` with `confirm: true` and the existing `customer_id`. The session charges the card directly and returns no `checkout_url`, so use webhooks to learn the payment result.

```javascript theme={null}
// `client` is an initialized DodoPayments client.
// Get the customer's saved payment methods
const methods = await client.customers.retrievePaymentMethods('cus_123');

// Charge the first saved card
const session = await client.checkoutSessions.create({
  product_cart: [{ product_id: 'pdt_123', quantity: 1 }],
  customer: { customer_id: 'cus_123' },
  payment_method_id: methods.items[0].payment_method_id,
  confirm: true,
  return_url: 'https://example.com/success'
});
```

## Testing

Use these cards in test mode. For more test data, see [Testing Process](/miscellaneous/testing-process).

<Tabs>
  <Tab title="Successful Payments">
    | Region | Brand | Card Number | Expiry | CVV |
    | :- | :- | :- | :- | :- |
    | US | Visa | `4242424242424242` | 06/32 | 123 |
    | US | Mastercard | `5555555555554444` | 06/32 | 123 |
    | India | Visa | `4576238912771450` | 06/32 | 123 |
    | India | Mastercard | `5409162669381034` | 06/32 | 123 |
  </Tab>

  <Tab title="Declined Payments">
    | Region | Brand | Card Number | Scenario |
    | :- | :- | :- | :- |
    | US | Visa | `4000000000000002` | Generic decline |
    | US | Visa | `4000000000009995` | Insufficient funds |
    | India | Visa | `4706131211212123` | Generic decline |
    | India | Mastercard | `5105105105105100` | Generic decline |
  </Tab>
</Tabs>

<Warning>
  Test cards work only in test mode. In live mode, a payment made with a test card fails.
</Warning>

## Security & Compliance

Dodo Payments applies these protections to card payments:

| Feature | Description |
| :- | :- |
| **PCI DSS Level 1** | The highest level of PCI DSS certification |
| **Tokenization** | Card numbers are tokenized on entry |
| **Fraud Scoring** | Real-time risk assessment |
| **CVV Validation** | Security code verification |
| **3D Secure** | Cardholder authentication |

## Best Practices

<AccordionGroup>
  <Accordion title="Accept all major networks">
    Don't restrict card types unless you need to. Customers expect their preferred card to work.
  </Accordion>

  <Accordion title="Display card logos">
    Show Visa, Mastercard, and Amex logos on your site to build trust.
  </Accordion>

  <Accordion title="Handle declines gracefully">
    Show clear error messages. Don't show raw error codes to customers.
  </Accordion>

  <Accordion title="Enable saved cards for returning customers">
    Saved payment methods make repeat purchases faster for returning customers.
  </Accordion>
</AccordionGroup>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Card declined">
    **Causes:** Insufficient funds, an expired card, an incorrect CVV, or the bank's fraud protection.

    **Solution:** Ask the customer to check their details or try a different card. Look up the decline's error code and its recommended action in the [Transaction Failures](/api-reference/transaction-failures) reference. See [Handle Payment Failures](/developer-resources/handle-payment-failures) to handle declines in code.
  </Accordion>

  <Accordion title="3DS authentication failed">
    **Causes:** The customer abandoned the challenge, the bank's system was unavailable, or the challenge timed out.

    **Solution:** Retry, or ask the customer to contact their bank. See [Handling Authentication Failures](#handling-authentication-failures) for the payment states and decline codes involved.
  </Accordion>

  <Accordion title="Card not supported">
    **Causes:** The regional network isn't supported, or the card is a restricted prepaid card.

    **Solution:** Ask the customer to try a card from a major network.
  </Accordion>
</AccordionGroup>

## Related Pages

<CardGroup cols={2}>
  <Card title="Payment Methods Overview" icon="layer-group" href="/features/payment-methods">
    All supported payment methods.
  </Card>

  <Card title="Upsells & Downsells" icon="arrow-up-right-dots" href="/features/upsells-and-downsells">
    One-click purchases with saved cards.
  </Card>

  <Card title="Testing Process" icon="flask" href="/miscellaneous/testing-process">
    Test data for every payment method.
  </Card>

  <Card title="Subscriptions" icon="repeat" href="/features/subscription">
    Recurring billing with cards.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.