Strong Customer Authentication requires an additional step of customer authentication, but sometimes you collect payments when your customer isn’t actively using your application. Even if they authenticated in the past, SCA may require your customer to come back online and re-authenticate. To reduce friction in these off-session payments, Stripe APIs enable upfront authentication—so you can authenticate your customer on-session once and reuse the card off-session repeatedly. As of September 14, 2019, you need to use these APIs to reduce the chance of failed payments when reusing cards or creating subscriptions and invoices.
However, you can use previous authorization agreements for off-session payments that meet the following criteria:
- Cards from EU customers saved before December 31, 2020
- Cards from UK customers saved before September 14, 2021
This means you don’t have to use Stripe’s new APIs to set up saved cards again, and your off-session payments can proceed normally—without re-authentication from customers.
How it works
You can use previous authorization agreements for all off-session payments that meet both of these conditions, regardless of payment amount and frequency:
- You saved the card details before the eligibility cutoff
- You explicitly tell Stripe the transaction is off-session
Stripe automatically looks for a transaction made with the card prior to the eligibility cutoff. If found, Stripe uses the previous authorization agreement for the current transaction. If the bank accepts the previous authorization agreement, the transaction is categorized as out of scope for SCA and can proceed without additional authentication.
If the bank declines the previous authorization agreement, it’s like any other PaymentIntent failing the confirmation step. The PaymentIntent’s status changes to requires_payment_method, and you have to notify your customer to complete the payment.
Saving cards after the eligibility period
Preparing your saved cards for SCA
For Stripe to reuse authorization agreements, you need to use PaymentIntents and tell Stripe the payment is off-session.
|How you saved the card before the eligibility cutoff||What to do after the eligibility period|
|By passing a token, source, or payment method to the ||Create a PaymentIntent with off-session flag|
|By creating a SetupIntent or using setup_future_usage in a PaymentIntent||Create a PaymentIntent with off-session flag|