Stripe · Decline codes
What does the Stripe authentication_required decline code mean?
Checked
Stripe returns authentication_required when the card's bank declines a payment because it needs the cardholder to verify it, usually through 3D Secure. It is not a refusal of the card itself. When the shopper is at checkout, Stripe's payment forms normally open the bank's verification step so they can approve and try again. For payments made without the customer present, such as a subscription renewal, the store has to bring the customer back to confirm the payment.
- Type
- Authentication needed (soft decline)
- Who declined
- The card's bank
- Retry
- Only after the cardholder completes the bank's verification
- Shopper action
- Approve the payment in the bank's verification step or banking app
- Merchant action
- Ask the customer to come back and confirm; do not resend the same charge blindly
What PlatformDTC does
At checkout PlatformDTC adds the hint "Your bank requires authentication. Please retry and complete the verification." and keeps the payment on the same processor for 3D Secure, never moving it to a backup processor. On renewals, on the fixed schedule or with Smart retry, it is not retried blindly: it is held past due and the customer gets an "action required" email asking them to confirm the payment with their bank.
Why it happens
Banks ask for extra verification when they want the cardholder to confirm a payment, and Stripe notes that businesses affected by regulations like Strong Customer Authentication will see payments that require authentication.
Stripe notes one odd case: if the bank returns this code even after the shopper completed verification, only the bank can explain why, so the customer needs to contact it.
What the shopper can do
Try the payment again and complete the verification screen or the approval prompt in your banking app. If the bank keeps declining after you verified, call the number on the back of the card.
What the store can do
For subscriptions and other payments taken while the customer is away, email the customer a link to confirm the payment. Retrying the same charge without them cannot succeed, because no one is there to answer the bank's challenge.
For developers
The code arrives as decline_code on the PaymentIntent's last_payment_error. Off-session, confirm the PaymentIntent on-session with the customer so Stripe can run the 3D Secure flow. Related Stripe codes: authentication_not_handled (the customer skipped the required step) and the API error payment_intent_authentication_failure (verification failed).
Frequently asked questions
- Is authentication_required a hard decline?
- No. The card can still be used. The bank only wants the cardholder to confirm this payment, so it goes through once they complete the verification.
- Why do subscription renewals get authentication_required?
- Renewals run without the customer present, so the bank's verification step cannot be shown. The customer has to return and confirm the payment, which is why stores email a confirmation link instead of retrying.
- The customer verified but still got authentication_required. Why?
- Stripe says that if the bank returns this code despite a successfully verified payment, the customer needs to contact the card issuer for more information.
Sources
- Stripe decline codes — Stripe
- Card declines and retries — Stripe
Related
- authentication_not_handled — Verification was required, the shopper skipped it, and the bank declined again.
- payment_intent_authentication_failure — The card failed the bank's authentication check (such as 3-D Secure).
- mobile_device_authentication_required — The payment needs authentication; the customer should tap their phone again.
- approve_with_id — The bank could not authorize the payment as sent; one more try may work.
- call_issuer — The bank declined without a reason and wants the cardholder to contact it.
- card_not_supported — The card can't be used for this kind of purchase.
- card_velocity_exceeded — The card's balance, credit limit or amount limit has been reached.
- currency_not_supported — The card can't be charged in the currency of the payment.