By default, with Stripe you create payments in one step, and with no further action on your part the funds will be sent to your bank account.

However, Stripe also supports two-step payments, often called auth and capture. If your integration uses this technique, it’s important to understand that approving a review and capturing a payment are separate actions.

Reviewing uncaptured payments in the Dashboard

When an uncaptured payment is placed in review, the Dashboard will display both a capture button and a set of buttons to close the review by approving or refunding. (For uncaptured payments, refunding is often called “releasing”.)

Important: approving the review will not automatically capture the charge. You will still need to click the capture button.

Using the API to automatically capture approved payments

Through the API, you can set up your integration to:

• Immediately capture payments not placed in review
• Leave payments placed in review uncaptured
• Once the review is approved, capture the payment

Immediately capture payments not placed in review

To create an uncaptured payment, set the capture behavior accordingly in the API request. On success, check the charge object’s Review attribute to see if the payment was placed in review; if the payment is a payment intent, check the payment intent’s Review attribute. If the attribute is empty, capture the charge.

# Set your secret key: remember to change this to your live secret key in production
# See your keys here: https://dashboard.stripe.com/account/apikeys
Stripe.api_key = 'sk_test_4eC39HqLyjWDarjtT1zdp7dc'

# Get the credit card details submitted by the form
token = params[:stripeToken]

begin
  # Create an uncaptured charge by passing capture=false
  charge = Stripe::Charge.create({
    amount: 1000, # Amount in cents
    currency: 'usd',
    source: token,
    description: 'Example charge',
    capture: false,
  })
  # Check if the payment is in review. If not, capture it.
  if !charge.review
    charge.capture
  end
rescue Stripe::CardError => e
  # The card has been declined
end

# Set your secret key: remember to change this to your live secret key in production
# See your keys here: https://dashboard.stripe.com/account/apikeys
Stripe.api_key = 'sk_test_4eC39HqLyjWDarjtT1zdp7dc'

# Get the credit card details submitted by the form
# Create a PaymentIntent with manual capture
intent = Stripe::PaymentIntent.create({
  amount: 1000, # Amount in cents
  currency: 'usd',
  source: {SOURCE_ID},
  description: 'Example charge',
  confirm: true,
  capture_method: 'manual',
})

# Check if the payment is in review. If not, capture it.
if !intent.review
  intent.capture
end

Capturing a payment after a review is approved

By design, the prior step left payments in review uncaptured. In this step you’ll use webhooks to automate the process of capturing these payments upon approval.

Start by configuring your webhooks to listen for the review.closed event. The event data includes the Review object, and the object’s reason attribute will indicate whether the review was approved, or if it was closed for some other reason (e.g., the payment was refunded).

// Review object included in review.closed event webhook.
{
  "id": "prv_08voh1589O8KAxCGPcIQpmkz",
  "object": "review",
  "charge": "ch_9E2sSCkzY5Ah08",
  "created": 1474379631,
  "livemode": false,
  "open": false,
  "reason": "approved"
}

If reason is 'approved', you’ll want to capture the charge.

# Set your secret key: remember to change this to your live secret key in production
# See your keys here: https://dashboard.stripe.com/account/apikeys
Stripe.api_key = 'sk_test_4eC39HqLyjWDarjtT1zdp7dc'

post "/my/webhook/url" do
  event_json = JSON.parse(request.body.read)
  event = Stripe::Event.retrieve(event_json["id"])

  if event.type == 'review.closed'
    review = event.object
    if review.reason == 'approved'
      ch = Stripe::Charge.retrieve(review.charge)
      ch.capture
    end
  end

  status 200
end

To capture approved payments, the review process must be completed within seven days. Otherwise, as with any other uncaptured payment, the authorization will automatically expire and the payment can no longer be captured.