Return [accepted] or Adyen
retries your webhook indefinitely.

Sessions API is the modern approach: one server-side call creates a session, and the Drop-in UI handles everything else — including 3DS challenges, redirects, and method-specific flows. Payments API is the legacy approach where you orchestrate each step yourself: POST /payments, handle the action object, redirect for 3DS, then POST /payments/details. Sessions API is recommended for all new integrations unless you need full server-side control over the payment flow.

No. The mock accepts any string for merchantAccount and doesn't validate it. In production you'd use the merchant account code from your Adyen Customer Area (typically YourCompanyECOM). The mock ignores it entirely — you only need it in the request body because Adyen's real API requires it and your integration code should be sending realistic payloads.

Always on the webhook. The returnUrl fires when the customer is redirected back to your site after 3DS. But the browser redirect can fail: the customer might close the tab, lose connectivity, or hit back. The AUTHORISATION webhook fires server-to-server regardless of what the browser does. Check eventCode === 'AUTHORISATION' and success === 'true' before fulfilling.

PENDING means the payment method was accepted but the result is not immediate — common for bank transfers (SEPA, Sofort, BLIK) and voucher methods (Boleto, OXXO). Adyen will fire an AUTHORISATION webhook when the transfer settles, which can be minutes or days depending on the method. Show the customer a 'payment submitted' confirmation, then fulfill only after the webhook.

When using the Sessions API with Drop-in, 3DS is handled entirely inside the Drop-in component — your server code never sees it. When using Payments API directly, the mock returns an action object with type set to redirect or threeDS2 when 3DS is required. Your code must read action.type and handle the redirect. The mock lets you force this response by passing a specific test card or a simulate_3ds flag in the request body.