---
id: ts12-risk-based-authentication
title: "TS12: Risk-based Authentication"
hide_title: false
sidebar_label: Risk-based Authentication
description: TS12 SCA workflow for risk-based step-up authentication using a Payment Service User credential, including transaction data for login and risk actions.
keywords: [TS12, SCA, risk-based authentication, payment service user, step-up authentication, OpenID4VP, EUDI Wallet, verifiable credentials]
slug: /ts12-risk-based-authentication/
last_update:
  date: 2026-08-20
---

> **Build this with an AI coding agent.** Install the iGrant.io Agent Skills, then ask your agent to build the integration:
>
> ```bash
> npx skills add L3-iGrant/skills
> ```


import { ApiKeyManager } from "@site/src/components/ApiKeyManager";
import DcqlStepTemplate from "@site/src/components/DCQL/DcqlStepTemplate";

TS12 SCA risk-based authentication enables a relying party to perform step-up authentication by requesting a Payment Service User credential with transaction data that captures the login context and risk action.

## Step 1: Get the API Key (Issuer Admin)

To obtain your API key, please contact [support@igrant.io](mailto:support@igrant.io?subject=Request%20API%20Key). Once you have received your API key, enter it in the field below and click the **Set API Key** button to save it for future use.

<ApiKeyManager />

## Step 2: Create Credential Definition (Issuer Admin)

To create a credential definition, run the interactive block below using the **Run** button. Alternatively, you can manually copy the JSON and use it in the body of the API available [here](/docs/openid4vc-api/config-create-digital-wallet-open-id-credential-definition).

From the API response, the `credentialDefinitionId` and `id` value from the `credentialDefinitions` array are autofilled in Step 3 automatically (and updated whenever Step 2 is re-run).

<DcqlStepTemplate
  initialJsonData={{
    label: "Payment Service User",
    trustAnchor: "did:key",
    version: "version_01",
    kid: "",
    enforceWUA: false,
    supportInteractiveAuthorisationEndpoint: true,
    credentialDefinitions: [
      {
        label: "Payment Service User Credential - TS12",
        expirationInDays: 60,
        supportRevocation: true,
        validationPath: "$",
        revocationMethod: "status_list",
        enforceCredentialUniqueness: false,
        supportCredentialReissuance: false,
        credentialBindingMethods: ["did:key", "jwk", "kid", "x5c"],
        authorizationRequestType: "authorization_details",
        scope: "",
        display: {
          name: "Payment Service User",
          description: "Payment Service User credential for SCA",
        },
        credentialResponseInterval: 20,
        credentialFormat: "dc+sd-jwt",
        vct: "https://oid4vc.igrant.io/service/vct-metadata/payment_service_user",
        claims: {
          claims: [],
        },
      },
    ],
  }}
  endpointPath="/v2/config/digital-wallet/openid/sdjwt/credential-definition"
  method="POST"
  extractJsonResponse={(result) => result}
  emitCredentialDefinitionIdsEvent="ts12RiskBasedAuthentication:credentialDefinitionCreated"
/>

## Step 3: Issue and Receive Credential (Issuer/Holder)

When you run Step 2 on this page, the `credentialDefinitionId` and `credentials[].id` fields below are autofilled automatically (and updated whenever Step 2 is re-run). If you are executing the APIs yourself, replace `<credentialDefinitionId>` and `<id>` with the values obtained from Step 2. The holder of the wallet submits a request for the issuance of a credential by executing the JSON code block below using the **Run** button in `InTime` issuance mode. Alternatively, you may use the API available [here](/docs/openid4vc-api/config-digital-wallet-open-id-issue-credential).

After receiving the response, you can toggle the switch to dynamically generate a QR code. The EUDI Wallet/Holder can then accept the credential offer using the [Data Wallet](https://www.igrant.io/datawallet.html) (or any other EU Digital Identity Wallet) by either scanning the QR code or by directly accessing the credential offer on their mobile device (e.g. via a browser).

<DcqlStepTemplate
  initialJsonData={{
    issuanceMode: "InTime",
    credentialDefinitionId: "<credentialDefinitionId>",
    urlScheme: "openid-credential-offer://",
    credentials: [
      {
        id: "<id>",
        claims: {},
      },
    ],
    userPin: "",
  }}
  endpointPath="/v2/config/digital-wallet/openid/sdjwt/credential/issue"
  method="POST"
  extractJsonResponse={(result) => result}
  extractQrValue={(result) => result?.credentialHistory?.credentialOffer}
  listenCredentialDefinitionIdsEvent="ts12RiskBasedAuthentication:credentialDefinitionCreated"
/>

To receive and accept the credential via API. First, use the `credentialOffer` to call the [Receive Credential API](https://docs.igrant.io/docs/openid4vc-api/config-receive-digital-wallet-open-id-credential/). Once you have the response, copy the `credentialId` and provide it at [Accept Credential API](https://docs.igrant.io/docs/openid4vc-api/config-accept-digital-wallet-open-id-credential/) to accept the credential.

## Step 4: Create Presentation Definition (Verifier Admin)

To create a presentation definition for requesting proof, you can run the code block below using the **Run** button. Alternatively, you can manually copy the code block and use it in the body of the API request provided [here](/docs/openid4vc-api/config-digital-wallet-open-id-presentation-definition).

Once a presentation definition has been created, the `presentationDefinitionId` is autofilled in Step 5 automatically (and updated whenever Step 4 is re-run). You can also reuse the same `presentationDefinitionId` to verify multiple credentials.

<DcqlStepTemplate
  initialJsonData={{
    label: "Risk-based Authentication",
    kid: "",
    trustAnchor: "did:key",
    version: "version_01",
    scope: "",
    responseType: "vp_token",
    enforceWUA: false,
    transactionDataDefinitionType: "login_risk_transaction",
    transactionDataDefinition: {
      $schema: "https://json-schema.org/draft/2020-12/schema",
      type: "object",
      properties: {
        transaction_id: {
          type: "string",
          maxLength: 36,
          minLength: 1,
          examples: ["8D8AC610-566D-4EF0-9C22-186B2A5ED793"],
        },
        date_time: {
          type: "string",
          format: "date-time",
          examples: ["2025-11-13T20:20:39+00:00"],
        },
        service: {
          type: "string",
          maxLength: 100,
          examples: ["Superbank Onlinebanking"],
        },
        action: {
          type: "string",
          maxLength: 140,
          examples: ["Login to your online account."],
        },
      },
      additionalProperties: false,
      required: ["transaction_id", "action"],
    },
    clientIdScheme: "redirect_uri",
    responseMode: "direct_post",
    dcqlQuery: {
      credentials: [
        {
          id: "Payment Service User Credential - TS12",
          format: "dc+sd-jwt",
          meta: {
            vct_values: [
              "https://oid4vc.igrant.io/service/vct-metadata/payment_service_user",
            ],
          },
          require_cryptographic_holder_binding: true,
          multiple: false,
        },
      ],
    },
  }}
  endpointPath="/v2/config/digital-wallet/openid/sdjwt/presentation-definition"
  method="POST"
  extractJsonResponse={(result) => result}
  emitPresentationDefinitionIdEvent="ts12RiskBasedAuthentication:presentationDefinitionCreated"
/>

## Step 5: Create Verification Request (Verifier/Relying Party)

When you run Step 4 on this page, the `presentationDefinitionId` field below is autofilled automatically (and updated whenever Step 4 is re-run). If you are executing the APIs yourself, replace `<presentationDefinitionId>` with the ID obtained in Step 4. To create the verification request, execute the code block below using the **Run** button. Alternatively, you can manually copy the JSON and use it in the body of the API available [here](/docs/openid4vc-api/config-create-digital-wallet-open-id-verification-request-v-3). This step includes `transactionData` in the verification request payload, which is specific to TS12 SCA workflows. The `transactionData.payload` contains the transaction details that are dynamically linked to the user's authentication.

After receiving the response, toggle the button provided to dynamically generate a QR code. The EUDI Wallet/Holder can then accept the verification request using the Data Wallet (or any other EU Digital Identity Wallet) by either scanning the QR code or directly accessing the verification request on their mobile device, such as via a browser.

<DcqlStepTemplate
  initialJsonData={{
    requestByReference: true,
    transactionData: {
      payload: {
        transaction_id: "login-session-abc123xyz",
        date_time: "2026-05-05T12:00:00.000Z",
        service: "Piggy bank Online Banking",
        action: "Log in from a new device (iPad) and view transaction history.",
      },
    },
    presentationDefinitionId: "<presentationDefinitionId>",
  }}
  endpointPath="/v3/config/digital-wallet/openid/sdjwt/verification/send"
  method="POST"
  extractJsonResponse={(result) => result}
  extractQrValue={(result) => result?.verificationHistory?.vpTokenQrCode}
  listenPresentationDefinitionIdEvent="ts12RiskBasedAuthentication:presentationDefinitionCreated"
/>

Users can copy the `presentationExchangeId` from the JSON response to track verification history. The Verifier (Relying Party) receives the requested credentials and can verify it. They may read the received credential by executing the [Read Verification History API](/docs/openid4vc-api/config-read-digital-wallet-open-id-verification-history-v-3).