Stripe Error: authentication_required — SCA Required

// Failing pattern — confirms server-side, no SCA flow:
const intent = await stripe.paymentIntents.create({
  amount: 4999,
  currency: 'gbp',
  payment_method: 'pm_card_authenticationRequired',
  confirm: true,
});
// intent.status === 'requires_action'
// intent.last_payment_error.code === 'authentication_required'
// intent.last_payment_error.decline_code === 'authentication_required'

authentication_required is Stripe’s signal that the card issuer wants the customer to prove they are the cardholder via 3D Secure (3DS), and your checkout flow either skipped that step or the customer abandoned it. Under PSD2 in the EEA — and increasingly worldwide — issuers reject any online charge that bypasses Strong Customer Authentication when they expect it.

The right answer is almost never server-side. Move authentication into Stripe.js (Payment Element or confirmCardPayment), which handles the 3DS modal, fallback to 3DS1 for older cards, exemption requests, and the requires_action polling for you. Once your client-side flow is set up correctly, authentication_required errors should drop to near-zero and your EEA conversion rates climb noticeably.

Why this happens

• Issuer-mandated SCA under PSD2 / EEA rules. Since 14 September 2019 (with rolling enforcement to March 2022), almost every EEA-issued card requires Strong Customer Authentication on most online charges. The issuer flags the transaction as needing 3DS and Stripe surfaces `authentication_required` if your flow doesn't run the challenge.
• Confirming a PaymentIntent server-side without Stripe.js. If you call `paymentIntents.create({ confirm: true })` on the server without first running the customer through Stripe.js's `confirmPayment`, the SCA flow has no UI to render. The intent enters `requires_action` and your charge fails until you bring the customer back in front of Stripe.js.
• Off-session charge on a payment method with no prior authenticated setup. Off-session charges (subscriptions, saved-card retries) only succeed when the customer originally set up the card with SCA *and* you're charging in a way the issuer trusts (recurring with the same merchant, fixed amount). Without a prior authenticated SetupIntent, off-session charges that need SCA fail.
• Issuer fraud signal triggering step-up authentication. Even outside the EEA, issuers may unexpectedly request 3DS for high-value, cross-border, or pattern-anomaly transactions. US/CA issuers are increasingly using 3DS2 for risk-based step-up. Your code must always be prepared to handle `requires_action` regardless of card country.
• Customer abandoned the 3DS challenge mid-flow. The customer saw the 3DS modal but closed it, switched tabs, or the popup was blocked. The PaymentIntent stays in `requires_action`. Retrying without re-running the challenge fails with the same code.

How to fix it

Fixes are ordered by likelihood. Start with the first one that matches your context.

// Server: create PaymentIntent (do NOT confirm yet)
// const intent = await stripe.paymentIntents.create({ amount, currency, automatic_payment_methods: { enabled: true } });
// Send intent.client_secret to client.

// Client:
const stripe = Stripe('pk_live_...');
const elements = stripe.elements({ clientSecret });
const paymentElement = elements.create('payment');
paymentElement.mount('#payment-element');

form.addEventListener('submit', async (e) => {
  e.preventDefault();
  const { error } = await stripe.confirmPayment({
    elements,
    confirmParams: { return_url: 'https://example.com/return' },
  });
  if (error) console.error(error.message);
});

const result = await stripe.confirmCardPayment(clientSecret, {
  payment_method: paymentMethodId,
});
if (result.error) {
  if (result.error.code === 'card_declined' &&
      result.error.decline_code === 'authentication_required') {
    // Customer cancelled 3DS — surface a retry button
    showRetry('Your bank requires extra verification. Please try again.');
  } else {
    showError(result.error.message);
  }
} else if (result.paymentIntent.status === 'succeeded') {
  showSuccess();
}

const intent = await stripe.paymentIntents.create({
  amount: 4999,
  currency: 'gbp',
  customer: customerId,
  payment_method: paymentMethodId,
  setup_future_usage: 'off_session',
  confirm: true,
});

Detection and monitoring in production

Track `authentication_required` separately from other `card_declined` reasons. A spike usually means (a) you've expanded into the EEA without updating your checkout, (b) a customer segment newly subject to PSD2 enforcement, or (c) a regression that bypassed your SCA flow. In Stripe Dashboard, the Payments analytics tab breaks down decline reasons over time.