How to handle SCA (Strong Customer Authentication) in Stripe

1const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);
2
3async function createPayment(amount, paymentMethodId) {
4  const paymentIntent = await stripe.paymentIntents.create({
5    amount: amount, // in cents
6    currency: 'eur',
7    payment_method: paymentMethodId,
8    confirmation_method: 'manual',
9    confirm: true,
10    payment_method_options: {
11      card: {
12        request_three_d_secure: 'automatic', // Let Stripe decide
13      },
14    },
15    return_url: 'https://yoursite.com/payment/complete',
16  });
17
18  return paymentIntent;
19}

1const express = require('express');
2const app = express();
3app.use(express.json());
4
5app.post('/api/pay', async (req, res) => {
6  try {
7    const { paymentMethodId, amount } = req.body;
8
9    const paymentIntent = await stripe.paymentIntents.create({
10      amount,
11      currency: 'eur',
12      payment_method: paymentMethodId,
13      confirm: true,
14      automatic_payment_methods: { enabled: true, allow_redirects: 'never' },
15    });
16
17    if (paymentIntent.status === 'requires_action') {
18      // Customer needs to authenticate
19      res.json({
20        requiresAction: true,
21        clientSecret: paymentIntent.client_secret,
22      });
23    } else if (paymentIntent.status === 'succeeded') {
24      res.json({ success: true });
25    } else {
26      res.json({ status: paymentIntent.status });
27    }
28  } catch (err) {
29    res.status(400).json({ error: err.message });
30  }
31});

1// Frontend JavaScript
2const stripe = Stripe('pk_test_yourPublishableKey');
3
4async function handlePayment(paymentMethodId, amount) {
5  const response = await fetch('/api/pay', {
6    method: 'POST',
7    headers: { 'Content-Type': 'application/json' },
8    body: JSON.stringify({ paymentMethodId, amount }),
9  });
10  const data = await response.json();
11
12  if (data.requiresAction) {
13    // Show the 3D Secure challenge
14    const { paymentIntent, error } = await stripe.handleCardAction(
15      data.clientSecret
16    );
17
18    if (error) {
19      showError(error.message);
20      return;
21    }
22
23    // Confirm the payment on the server after authentication
24    const confirmResponse = await fetch('/api/confirm-payment', {
25      method: 'POST',
26      headers: { 'Content-Type': 'application/json' },
27      body: JSON.stringify({ paymentIntentId: paymentIntent.id }),
28    });
29    const confirmData = await confirmResponse.json();
30    showResult(confirmData);
31  } else if (data.success) {
32    showSuccess('Payment completed!');
33  }
34}

1app.post('/api/confirm-payment', async (req, res) => {
2  try {
3    const paymentIntent = await stripe.paymentIntents.confirm(
4      req.body.paymentIntentId
5    );
6
7    if (paymentIntent.status === 'succeeded') {
8      res.json({ success: true });
9    } else if (paymentIntent.status === 'requires_action') {
10      // Customer failed authentication
11      res.json({ requiresAction: true, clientSecret: paymentIntent.client_secret });
12    } else {
13      res.json({ status: paymentIntent.status });
14    }
15  } catch (err) {
16    res.status(400).json({ error: err.message });
17  }
18});

1// SCA test cards (use any future expiry and any 3-digit CVC):
2//
3// 4000002500003155 — Requires authentication (always triggers 3DS)
4// 4000002760003184 — Requires authentication (always triggers 3DS)
5// 4000008260003178 — Authentication fails
6// 4242424242424242 — No authentication required (non-SCA card)
7// 4000003800000446 — SCA required, successful authentication
8
9// Example: Create a payment with a card that requires SCA
10async function testSCA() {
11  const pm = await stripe.paymentMethods.create({
12    type: 'card',
13    card: {
14      number: '4000002500003155', // Requires authentication
15      exp_month: 12,
16      exp_year: 2027,
17      cvc: '123',
18    },
19  });
20
21  const pi = await stripe.paymentIntents.create({
22    amount: 2000,
23    currency: 'eur',
24    payment_method: pm.id,
25    confirm: true,
26    return_url: 'https://yoursite.com/complete',
27  });
28
29  console.log('Status:', pi.status); // 'requires_action'
30}