Save cards with consent and charge renewals off-session

How to do it

Charges you start without the customer present, such as renewals, are merchant-initiated transactions. They fall outside SCA when the first payment set up the agreement with SCA. Tell the provider at setup that the card is for future use, such as setup_future_usage: "off_session" at Stripe. Show the terms beside the pay button, such as "Example Bakery charges 129.50 SEK every month until you cancel". Mark each later charge as off-session. If the bank still asks for authentication, email the customer a link to finish it. Record the consent as Show the terms and record consent before the first charge says.

Examples

JavaScript example

await stripe.paymentIntents.create({
  amount: 12950,
  currency: 'sek',
  customer: customerId,
  payment_method: savedPaymentMethodId,
  off_session: true,
  confirm: true,
}, { idempotencyKey: `renewal-${subscriptionId}-${periodStart}` })

Python example

stripe.PaymentIntent.create(
    amount=12950,
    currency="sek",
    customer=customer_id,
    payment_method=saved_payment_method_id,
    off_session=True,
    confirm=True,
    idempotency_key=f"renewal-{subscription_id}-{period_start}",
)

How to check

On staging, start a subscription with a card that needs authentication unless it was set up, such as Stripe's 4000 0025 0000 3155. The first payment shows a challenge. The renewal a month later, run with the provider's test clock, succeeds without one.

Sources

• Regulation (EU) 2018/389 on strong customer authentication
• PSD2 Directive (EU) 2015/2366, Article 97

Related rules

• PAY-2 Handle 3-D Secure in every card flow in Payments and billing
• PAY-28 Show the terms and record consent before the first charge in Payments and billing
• PAY-37 Keep saved cards up to date in Payments and billing
• USG-9 Decide in writing what happens at a zero balance in Usage-based billing