Skip to the tool
MoveAheadPayments Toolbox
Webhook capture

Stripe decline code: authentication_required

The card was declined because the transaction requires authentication such as 3-D Secure. It is not a refusal of the payment — it is a request for the cardholder to prove who they are, and the payment can usually still complete.

authentication_requiredAction required

Someone has to do something before this can succeed.

What it means

The issuer soft-declined pending strong customer authentication. Stripe's documentation notes that with Stripe's own front ends a soft decline from an issuer normally triggers an authentication flow automatically, letting the customer authenticate and retry. Where it surfaces to you as an error it is usually an off-session payment — a subscription renewal, say — with no customer present to complete the challenge. Stripe also documents a related `authentication_not_handled`, which is what you get if you proceed without running the required authentication.

Common causes

  • An off-session payment, such as a subscription renewal, that the issuer wants authenticated.
  • A first payment in a region enforcing strong customer authentication, without 3-D Secure in the flow.
  • An integration that captured the card without setting up a mandate or off-session usage, so no exemption applies.
  • An issuer applying its own step-up rules to a transaction it considers higher risk.

How to fix it

  1. On-session, let Stripe's front end run the 3-D Secure flow. That is what it is for, and the payment usually completes.
  2. Off-session, bring the customer back on-session to authenticate — Stripe's documented step is to request that the customer retry.
  3. Set up future off-session payments correctly at the time you save the card, so the mandate exists before the renewal needs it.
  4. Do not treat it as a hard decline. Counting authentication requests as lost payments understates a recoverable population.

Tools that help

Frequently asked questions

Why does this happen on subscription renewals but not at checkout?
Because there is nobody there to authenticate. At checkout the 3-D Secure challenge is shown and the customer completes it; on an off-session renewal there is no browser to show it in. Setting the payment up for off-session use when the card is first saved is what establishes the mandate that avoids most of these.
What is authentication_not_handled?
Stripe's separate code for proceeding without running the authentication that was asked for — the issuer asked, you did not, so it declined again. The fix is to run the 3-D Secure flow rather than retrying past it.