# PaymentSheetConfiguration

Groups the credentials, environment flag, and optional 3D Secure configuration passed to [CompletePaymentSheet](/android/online/payment-sheet). Previously these were top-level composable parameters; they've been moved into a dedicated class so future options can be added without widening the composable signature.


```kotlin
data class PaymentSheetConfiguration(
    val applicationId: String,
    val environment: PaymentSheetEnvironment,
    val merchantId: String? = null,
    val apiUsername: String? = null,
    val apiPassword: String? = null,
    val threeDSConfiguration: ThreeDSConfiguration? = null,
)
```

| Property | Type | Required | Description |
|  --- | --- | --- | --- |
| `applicationId` | `String` | Yes | Your Finix Application ID, found in the Finix Dashboard. Application IDs are environment-specific — use the one that matches `environment`. |
| `environment` | `PaymentSheetEnvironment` | Yes | The Finix environment the SDK targets: `PaymentSheetEnvironment.LIVE`, `PaymentSheetEnvironment.SANDBOX`, or `PaymentSheetEnvironment.QA`. |
| `merchantId` | `String?` | No | Finix Merchant ID. Required when `threeDSConfiguration` is set — the SDK forwards it to `/3d_secure_sessions`. |
| `apiUsername` | `String?` | No | Finix API username used to authenticate the 3DS session call. |
| `apiPassword` | `String?` | No | Finix API password used to authenticate the 3DS session call. |
| `threeDSConfiguration` | `ThreeDSConfiguration?` | No | When set, runs 3D Secure authentication after tokenization. Omit (or pass `null`) to leave 3DS disabled. See [ThreeDSConfiguration](#threedsconfiguration). |


Do not embed production API credentials
`apiUsername` and `apiPassword` are privileged Finix API credentials — even `ROLE_MERCHANT` keys can create Transfers (see [API Keys](/additional-resources/developers/authentication-and-api-basics/api-keys)). Credentials embedded in a distributed APK can be extracted and reused by an attacker. For live mode, mint short-lived or scope-restricted credentials from your backend and inject them at runtime, or proxy the 3DS session call through your backend rather than shipping the live account key with the app.

## PaymentSheetEnvironment

Selects which Finix environment the SDK targets. Pair the value with the matching `applicationId` and (when 3DS is enabled) the matching API credentials.


```kotlin
enum class PaymentSheetEnvironment {
    LIVE,
    SANDBOX,
    QA,
}
```

## ThreeDSConfiguration

Enables 3D Secure (3DS) card authentication after tokenization. When set on `PaymentSheetConfiguration`, the SDK calls `/3d_secure_sessions`, presents a WebView challenge if required, and polls the session until it reaches a terminal state. The outcome is returned via [PaymentSheetResponse.threeDSResponse](/android/online/token-response#threedsresponse).

If `threeDSConfiguration` is `null`, tokenization behaves exactly as before — existing integrations are unaffected.


```kotlin
data class ThreeDSConfiguration(
    val redirectScheme: String,
    val isEnabled: Boolean,
)
```

| Property | Type | Required | Description |
|  --- | --- | --- | --- |
| `redirectScheme` | `String` | Yes | Custom URL scheme the issuer's challenge page returns to when authentication completes. Must match an intent-filter in your app's `AndroidManifest.xml` — see [Register the redirect URL scheme](/android/online/#register-the-redirect-url-scheme). |
| `isEnabled` | `Boolean` | Yes | Set to `false` to construct a `ThreeDSConfiguration` without triggering 3DS. Useful for runtime toggles. Unlike the iOS counterpart, this parameter has no default — pass it explicitly. |


The `redirectScheme` tells the SDK which URL to listen for when the issuer's challenge page redirects back to your app. Register the same scheme in your `AndroidManifest.xml` or the SDK will time out waiting for the redirect.


```kotlin
val threeDS = ThreeDSConfiguration(
    redirectScheme = "yourappscheme://redirect",
    isEnabled = true,
)
```

Compose a `PaymentSheetConfiguration` with 3D Secure enabled.