Static Password

The Static Password challenge method represents the knowledge factor in SCA. When enabled, cardholders must enter their pre-set password to authenticate the transaction.

Knowledge Factor

Proves the cardholder knows their secret password.

Simple Setup

No external integrations required for basic configuration.

Delegate Option

Optionally delegate password verification to your own systems.


How It Works

  1. Cardholder initiates a transaction
  2. Apata presents password entry screen
  3. Cardholder enters their password
  4. Apata verifies against stored password (or delegates to issuer)
  5. Transaction proceeds or fails based on verification

Configuration

Basic Settings
FieldDescription
NameUser-friendly identifier
AliasUnique identifier (alphanumeric, dashes, underscores). Cannot be changed after creation.
DescriptionOptional details about the method
Attempt Settings
FieldDefaultDescription
Attempts3Max incorrect entries before failure
TTL300sTime limit to complete challenge (5 minutes)
📘

Static Password does not have a "Retries" setting since there's nothing to resend.

Authentication Method
FieldDescription
Default Value(01) Static Passcode - reported to payment schemes
MatchersOverride auth method value based on Protocol Version
Delegate Options
OptionDescription
Delegate VerifyApata sends entered password to your Webhook for verification
Delegate CancelReceive notification when cardholder cancels challenge
📘

Delegate options require a Webhook to be configured first.

Benefits of Delegate Verify:

  • Password never stored in Apata
  • Use your existing password verification system
  • Full control over password policies
Additional Options
OptionDescription
Show Info Screen When Missing DetailsDisplay informational screen if password is not configured
Challenge InterfaceSelect or customise the UI via Challenge Interface Builder

Password Storage Options

The password is stored with the card enrolment and verified by Apata directly.

Pros:

  • Simple setup
  • No webhook integration needed

Cons:

  • Password stored externally

Common Use Cases

Second Factor Authentication

Static Password is commonly used as a second factor combined with:

  • SMS OTP (possession) + Static Password (knowledge)
  • Email OTP (possession) + Static Password (knowledge)

This combination satisfies PSD2 SCA requirements.

Fallback Method

Can be configured as a fallback when other methods fail:

  • If OOB fails → fall back to Static Password
  • If Behavioural Biometrics fails → fall back to Static Password

API References

WebhookDescription
Delegate VerifyVerify cardholder-entered password
Delegate CancelCardholder cancelled notification

Related Topics

  • Challenge Profile – Combine Static Password with other methods
  • Challenge Interface – Customise the password entry screen
  • Webhook – Configure delegate endpoints
  • SCA – Strong Customer Authentication requirements