Authorize now, capture later: holding orders for review

A card payment has two steps. Authorization is when the card issuer approves the payment and the amount is held on the buyer's card. Capture is when the funds are actually collected. Most stores do both at once. Stripe lets you separate them, so you can authorize an order at checkout and capture it only after someone has reviewed it.

For a research supplier, that gap is where a manual review fits. This page explains how separate authorization and capture works according to Stripe's documentation, the time limits Stripe states, and how to use it for order review.

How separate authorization and capture works

Stripe calls this placing a hold on a payment method, and notes that it is sometimes called manual capture. Stripe explains that authorizing a payment holds the amount on the customer's payment method. You then need to capture the funds before the authorization expires. If it expires first, the funds are released and the payment's status changes to canceled.

1. At checkout, the payment is created with its capture method set to manual.
2. The buyer's card is authorized. Stripe shows the payment as uncaptured, and the PaymentIntent's status becomes requires_capture.
3. Your team reviews the order.
4. If the order is approved, you capture the payment and ship. If it is declined, you cancel the payment and the hold is released.

You can do this through the API, and Stripe's documentation also describes authorizing a one-time payment from the Dashboard with a capture funds later option.

The time limits Stripe states

Stripe publishes authorization validity windows by card brand. For online (card-not-present) payments that the customer initiates, Stripe lists 7 days for Visa, Mastercard, American Express and Discover. For merchant-initiated online payments, Stripe lists 5 days for Visa, explaining that the exact window is 4 days and 18 hours to allow time for clearing, and 7 days for the other three brands. In-person card payments have shorter windows.

Stripe also describes extended authorizations for certain eligible online card payments, and different windows for other payment methods. These limits are set by Stripe and the card networks and can change, so check Stripe's current page before you set your review deadlines. Set your internal deadline well inside the window, so a review never ends with an expired authorization.

Capturing, partial capture and canceling

• Full capture. A capture request collects the full authorized amount by default.
• Partial capture. You can capture less than the authorized amount. Stripe says a partial capture automatically releases the rest.
• One capture. For most payments you can capture only once. If you capture part of the amount, you cannot capture the difference later.
• Canceling. To release an authorization without collecting, cancel the PaymentIntent. Stripe notes that an uncaptured payment cannot be refunded directly; it must be canceled.

The cost difference matters when you decline orders. Stripe says you can cancel a payment before it is completed at no cost, while refunding a payment after it succeeds might incur a fee, and its processing fees from the original transaction are not returned. Stripe's refunds documentation suggests separate authorization and capture to businesses that refund many payments shortly after the transaction.

What the buyer sees

Stripe notes that card statements from some issuers do not always distinguish between authorizations and captured payments, which can confuse customers. Tell buyers at checkout and in the order confirmation that some orders are reviewed before they are charged and shipped. If an order is held, say so, and say what you need from them.

A short, factual message works best. For example: "We have received your order and it is being reviewed. Your card has been authorized but not yet charged. We will be in touch if we need more information, and we will only charge your card once the order is approved." Keep the wording consistent with your terms of sale, and send it from an address the buyer can reply to.

Limits to plan for

• Not every payment method supports it. Stripe lists cards and several other methods as supporting separate capture, and names ACH Direct Debit among those that do not. If you accept a mix, you can set manual capture per payment method.
• Holds need people. A hold only helps if someone reviews it in time. Decide who reviews, how often the queue is checked, and what happens when a reviewer is away. Compliance roles for small teams covers who should approve what.
• Reviews in Radar are different. Stripe notes that payments placed in its Radar review queue are typically already processed, unless you capture authorized payments later. A review queue on its own does not hold funds.
• A hold is your control, not Stripe's decision. Holding orders for review is part of how you run your store. Stripe and the card networks make their own decisions about the businesses they support.

Using holds for manual review

A hold is most useful when it is tied to written rules. Decide which orders are held, for example orders with no organization name, a ship-to outside the destinations you serve, or a buyer type your profile does not cover. Decide what a reviewer checks and what clears the hold. Record each decision and the reason. Reviewing orders that look like consumer purchases sets out a full review process.

Claddr applies this to rules you write in plain terms. Matching orders are authorized but not captured until a reviewer on your team approves them, hold events are available by webhook, and each hold is stored in the order's tamper-evident audit record. Payments are processed by Stripe on your own Stripe account; see how Claddr works.