Decline code
Authentication required: what it means and what to do
The card issuer wants the customer to authenticate the payment, such as with 3D Secure. Why a retry can’t fix it, and what does.
- $29/month, flat
- Cancel anytime
- Restricted Stripe key only
What it means
Stripe returns authentication_required when the card issuer declined the payment because it needs the customer to authenticate, for example with 3D Secure.
At a checkout where the customer is present, Stripe usually starts the authentication step and lets them try again. On a subscription renewal the customer isn’t there, so nothing can ask them to authenticate.
From Stripe’s decline codes and card declines docs.
Should you retry it?
It is on Stripe’s list of hard declines, so Stripe can’t retry it automatically without a new payment method. A retry made without the customer there can’t complete authentication, so it fails again until they act.
From Stripe’s Smart Retries and card declines docs.
What to do about it
What the customer needs to do
- Come back and complete the authentication step, or add a card and authenticate it when asked.
- If the issuer returns this code even after a successful authentication, contact the card issuer, which is Stripe’s advice.
What you can do
- Notify the customer and ask them to visit your site, which is what Stripe advises for a payment made while they were away.
- Give them a page where they can add or confirm a card.
What Dunity does
- Dunity records the decline code and emails your customer once, with a link to update their card. That email is what brings them back to a page where they can act.
- Dunity’s own retries are made without the customer present, so a retry fails the same way. The first one that does ends the retries and the payment is marked Failed, in line with Stripe listing this code among its hard declines.
- The dashboard has no group of its own for it, so it shows under “Other”.
What Dunity does is read from its code, not assumed. The whole flow is on how Dunity works, and every code is on the decline codes hub.
Related decline codes
Authentication required questions
What people ask about this code.
Why does a retry fail with authentication_required?
The payment needs the customer to authenticate, and a retry made in the background can’t do that. Stripe lists the code among its hard declines, which means it can’t be retried without a new payment method. Dunity stops after the first retry that fails this way.
Is authentication_required a sign of fraud?
No. It is usually a soft decline: the issuer asks for an extra check and lets the customer try again once they authenticate.