---
title: "Save cards with consent and charge · Agent Wranglers"
url: https://agentwranglers.se/playbook/payments/card-security-and-sca/off-session-payments
id: PAY-3
level: Recommended
applies: payments, eu-users
updated: 2026-10-22
build: a2a6bdfed830
tokens: 1039
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Save cards with consent and charge renewals off-session

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Card security and SCA](https://agentwranglers.se/playbook/payments/card-security-and-sca.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: PAY-3
- Level: Recommended
- Chapter: [Card security and SCA](https://agentwranglers.se/playbook/payments/card-security-and-sca.md)
- Rule: To charge a card later, save it at the first payment with SCA and the customer's consent. Mark each later charge as merchant-initiated.
- Check: On staging, start a subscription with a card that needs authentication unless it was set up, such as Stripe's 4000 0025 0000 3155. The first payment shows a challenge. The renewal a month later, run with the provider's test clock, succeeds without one.
- Applies when: The project takes payments, or has users in the EU.
- How: Charges you start without the customer present, such as renewals, are merchant-initiated transactions. They fall outside SCA when the first payment set up the agreement with SCA. Tell the provider at setup that the card is for future use, such as `setup_future_usage: "off_session"` at Stripe. Show the terms beside the pay button, such as "Example Bakery charges 129.50 SEK every month until you cancel". Mark each later charge as off-session. If the bank still asks for authentication, email the customer a link to finish it. Record the consent as [Show the terms and record consent before the first charge](https://agentwranglers.se/playbook/payments/subscriptions/recurring-consent.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
await stripe.paymentIntents.create({
  amount: 12950,
  currency: 'sek',
  customer: customerId,
  payment_method: savedPaymentMethodId,
  off_session: true,
  confirm: true,
}, { idempotencyKey: `renewal-${subscriptionId}-${periodStart}` })
```

### Python example

```python
stripe.PaymentIntent.create(
    amount=12950,
    currency="sek",
    customer=customer_id,
    payment_method=saved_payment_method_id,
    off_session=True,
    confirm=True,
    idempotency_key=f"renewal-{subscription_id}-{period_start}",
)
```

## Sources

- [Regulation (EU) 2018/389 on strong customer authentication](https://eur-lex.europa.eu/eli/reg_del/2018/389/oj)
- [PSD2 Directive (EU) 2015/2366, Article 97](https://eur-lex.europa.eu/eli/dir/2015/2366/oj)

## Related rules

- PAY-2 [Handle 3-D Secure in every card flow](https://agentwranglers.se/playbook/payments/card-security-and-sca/strong-customer-authentication.md) in Payments and billing
- PAY-28 [Show the terms and record consent before the first charge](https://agentwranglers.se/playbook/payments/subscriptions/recurring-consent.md) in Payments and billing
- PAY-37 [Keep saved cards up to date](https://agentwranglers.se/playbook/payments/failed-payments-and-dunning/card-updates.md) in Payments and billing
- USG-9 [Decide in writing what happens at a zero balance](https://agentwranglers.se/playbook/usage-billing/credits-and-prepaid-balances/zero-balance-behaviour.md) in Usage-based billing

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/payments/card-security-and-sca/off-session-payments">Agent Wranglers payments and billing playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Handle 3-D Secure in every card flow](https://agentwranglers.se/playbook/payments/card-security-and-sca/strong-customer-authentication.md)
- Next: [Keep test and live modes apart](https://agentwranglers.se/playbook/payments/card-security-and-sca/test-and-live-keys.md)
- [Card security and SCA](https://agentwranglers.se/playbook/payments/card-security-and-sca.md)