Payment Authorization

Billing Payments

5 min read

Also known as: Card Authorization, Auth, Pre-Auth

Payment authorization is the issuer's approval to hold funds on a customer's card or account before the charge is actually captured and settled.

Definition

Payment authorization is the first half of a card transaction: your billing system asks the customer's bank to verify the account is valid and place a hold on the funds, but no money moves yet. The hold typically lasts 5-7 days and confirms the card can cover the charge.

In practice, your checkout or billing engine sends an auth request to the processor, which routes it to the card network and issuer. The issuer returns an approval code (or a decline reason), and your system either proceeds to capture the funds immediately or holds the auth until fulfillment, renewal, or a confirmation event triggers the capture.

Authorization is distinct from capture (the actual debit), settlement (funds landing in your merchant account), and pre-authorization (a verification hold without intent to capture, like at a hotel check-in). All four happen in sequence but are controlled separately by your billing logic.

Why It Matters

Auth-and-capture is the foundation of any billing flow where you charge after a delay — subscriptions, usage-based pricing, shipped goods, or service delivery. Doing it correctly cuts fraud losses, reduces chargebacks, and lets your finance team forecast cash with accuracy because you know which holds will convert to revenue.

Teams that skip clean auth logic end up double-charging customers, capturing on expired holds (which forces a re-auth and often a decline), or burning trust with surprise charges on cards the customer thought were just being verified. Worse, sloppy auth handling triggers issuer risk flags that lower your approval rates across the entire portfolio.

Examples in Practice

A SaaS company running annual contracts authorizes a customer's card at signup, captures on contract start date, and re-authorizes 30 days before renewal to confirm the card is still valid. If the pre-renewal auth fails, the success team gets a flag to update payment method before the actual renewal charge hits.

A mid-market ecommerce brand authorizes orders at checkout but only captures when the warehouse confirms shipment. This protects the customer from being charged for out-of-stock items and gives the brand a clean cancellation path without issuing refunds.

A managed-services agency authorizes a deposit on a new client's card when the proposal is countersigned, then captures it 24 hours later once the engagement letter is on file. The brief delay lets the client back out cleanly without a refund cycle if anything goes sideways during onboarding.

Frequently Asked Questions

What is payment authorization and why does it matter?

Payment authorization is the issuer's confirmation that a customer's card or account has sufficient funds and is in good standing, paired with a temporary hold on those funds. It matters because it lets you verify a payment method before fulfilling an order or starting a subscription, reducing fraud and failed charges. Without it, you'd be capturing blind and absorbing every bad card as a loss.

How is payment authorization different from payment capture?

Authorization is the approval and hold; capture is the actual transfer of funds from the customer's account toward your merchant account. You can authorize without ever capturing (the hold simply expires), but you cannot capture without first authorizing. Most modern billing flows separate the two so you can confirm fulfillment, shipment, or service delivery before money actually moves.

When should I use authorization-only versus auth-and-capture?

Use authorization-only when there's a gap between order and fulfillment — shipped goods, usage-based billing, or contract milestones. Use immediate auth-and-capture (also called a sale transaction) for instant digital delivery, point-of-sale, or any case where the customer gets value the moment they pay. Subscriptions usually combine both: auth at signup, capture on the billing date.

What metrics measure payment authorization performance?

The core metrics are authorization rate (approvals divided by attempts), decline rate broken out by reason code, expired auth rate, and re-auth success rate. Healthy ecommerce auth rates sit around 85-92%, while subscription renewals tend to run 75-88% depending on industry. Watching these by issuer and card type tells you where to negotiate with your processor.

What's the typical cost of payment authorization?

Most processors bundle authorization into the interchange-plus or flat rate they charge per transaction, typically 2.5%-3.5% plus $0.10-$0.30 per successful charge. Some processors charge a small fee (around $0.05-$0.15) for each auth attempt regardless of approval, which adds up if your decline rate is high. Pre-auths that never capture are usually free or near-free.

What tools handle payment authorization?

Authorization is handled by your payment processor or gateway in coordination with the card networks and issuing banks. Subscription billing platforms, ecommerce checkout engines, and AI-driven CRM billing layers all sit on top of a gateway and orchestrate when auths fire, when captures happen, and how retries are managed. The processor does the network call; your billing software decides the timing.

How do I implement payment authorization for a small team?

Pick a billing platform that already integrates auth-and-capture logic so you're not coding against raw gateway APIs. Decide your default flow (auth at order, capture at fulfillment is the safest for physical goods), set hold expiration alerts, and build a re-auth path for anything that sits longer than 5 days. Document decline reason codes so support knows which failures need a customer outreach.

What's the biggest mistake teams make with payment authorization?

Letting authorizations expire before capture and then trying to capture anyway. The capture silently fails or forces an unattended re-auth that often declines, which means the order ships but the money never arrives. The second-biggest mistake is using high pre-auth amounts (common in hospitality and rentals) without telling the customer, which generates support tickets and chargebacks.

How long does a payment authorization hold last?

Most card authorizations hold for 5-7 days for standard purchases, though debit card holds can drop off in 1-3 days and travel or hospitality auths can stretch to 30 days. The exact window is set by the issuing bank, not the merchant. If you don't capture within the hold window, you have to re-authorize before charging.

Can a payment authorization be reversed?

Yes — an authorization reversal (or auth void) tells the issuer to release the hold immediately rather than waiting for it to expire. This is the cleanest way to handle canceled orders because it doesn't create a refund on the customer's statement, just a removed pending charge. Most processors support reversals through the same API used to capture, but only before settlement.

The AMW Suite