Quick Start
This guide walks through the steps required to configure Apata and process your first live transaction, from creating a Financial Institution through to go-live.
Prerequisites
Before starting, ensure your Apata Account Manager has:
- Created your Organisation in the Apata system
- Set up admin users with Portal access
- Provided API credentials (if using API integration)
Step 1: Create a Financial Institution
- Log in to the Apata Portal
- Navigate to Financial Institutions in the left menu
- Click Create Financial Institution
- Fill in the required fields:
- Name: Your FI's display name
- Alias: A unique, permanent identifier (no spaces) used in API requests
- Description: Optional notes
- Click Create
Creating a Financial Institution automatically provisions a set of defaults so you can start testing immediately.
What's created automatically
| Default | Description |
|---|---|
| Risk Profile | Challenges all transactions by default. |
| SMS OTP Challenge Method | Pre-configured challenge method ready for use. |
| Challenge Profile | Links the default challenge method to the default card program. |
| Card Program | A default program applied to all cards unless overridden. |
Step 2: Add BIN Ranges
You need at least one BIN or Card Range to route transactions to your Financial Institution.
- Switch to the Organisation workspace using the top-left selector
- Navigate to BINs & Card Ranges
- Click + Create
- Configure:
- Scheme: Visa or Mastercard
- BIN Value or Range: start and end PAN
- Cryptogram settings: CAVV keys - coordinate with your Account Manager
- Under Financial Institution Access, enable your FI
- Save the BIN
For initial testing, you can use any BIN value. Update it to your production BIN before go-live.
Step 3: Configure Challenge Methods
A default SMS OTP challenge method is pre-configured. Customise or add methods as needed.
Send a one-time passcode to the cardholder via SMS.
Send a one-time passcode to the cardholder via email.
Approve via in-app push notification.
Verify against a fixed password stored in Apata.
Delegate authentication entirely to your own app.
Verify identity via issuer-configured security questions.
To configure a Challenge Method:
- Switch to your FI workspace
- Navigate to Challenge Methods
- Edit the default SMS OTP or create a new method
- Configure webhooks if using Delegate Send or Delegate Verify to hand off OTP delivery or verification to your systems
Step 4: Customise the Challenge Interface
The Challenge Interface is the UI presented to cardholders during authentication.
- Navigate to Challenge Interfaces in your FI workspace
- Edit the default interface or create a new one
- Customise:
- Branding (logos, colours)
- Copy and text content
- Supported language locales
- Create Challenge Interface Locales for each language you need to support
Step 5: Configure Risk Profile and Rules
The default Risk Profile challenges all transactions. Add Risk Rules to enable frictionless flows and apply exemptions.
- Navigate to Risk Profiles in your FI workspace
- Edit the default profile or create a new one
- Add rules based on your requirements:
Exempt transactions under €30 in accordance with PSD2.
Apply TRA to exempt low-risk transactions up to a configured value limit.
Allow frictionless flows for merchants the cardholder has previously whitelisted.
Challenge or accept based on transaction amount.
Apply different behaviour by MCC.
Adjust authentication behaviour based on merchant or device country.
Use Backtesting to evaluate the impact of new rules against historical transactions before applying them to live traffic.
Step 6: Set Up Card Link
Card Link enables Apata to fetch card details from your system on demand, eliminating the need for pre-Enrolment.
- Navigate to Card Link in your FI workspace
- Configure:
| Type | Description |
|---|---|
STANDARD_V1 | Standard card lookup. Apata calls your endpoint to retrieve card details. |
STANDARD_V1_WITH_RISK | Standard card lookup with an additional risk score returned from your system. |
- Implement the Card Link endpoint per the API reference
Step 7: Test with the Merchant Simulator
Use the Merchant Simulator to validate your configuration before going live.
- Navigate to Merchant Simulator in your FI workspace
- Click Add Test Card
- Select a BIN range and generate a test PAN
- Configure test card properties (phone number, email, password)
Step 8: Go Live
Pre-launch checklist
- Production BIN ranges configured and enabled
- Challenge Interface branded and localised
- Risk Profile rules reviewed and tested
- Card Link endpoint deployed and tested in production
- Webhooks configured for the Finalised Event
- CAVV keys exchanged with payment schemes
Once the checklist is complete:
- Update the DS: Work with your scheme contacts to redirect your BIN ranges to the Apata ACS URL
- Live card testing: Perform end-to-end tests with live test cards
- Enable traffic: Confirm all transactions are flowing through the Apata ACS
Key Concepts
Organisation - The top-level tenant in Apata, representing your company or an aggregator managing multiple issuers.
Financial Institution - An isolated issuer entity within an Organisation, with its own cards, settings, and authentication configuration.
Card Program - A grouping of cards within a Financial Institution that shares a common Risk Profile and Challenge Profile.
Challenge Profile - Defines which Challenge Methods are available to a cardholder and in what order.
Risk Profile - A set of rules evaluated on each transaction to determine whether to approve frictionlessly, challenge, or reject.
Card Link - Real-time card data retrieval from your systems, eliminating the need for pre-enrolment.
Support
For assistance during onboarding, contact your Apata Account Manager or reach out to the Apata Sales team at [email protected].
Updated 18 days ago